From c332f8ad0def6fc24ab2ebe41ba8dda424e65b5b Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Fri, 6 Feb 2026 21:09:55 +0100
Subject: [PATCH] Cap interceptable binder payload size at 256KB

Prevents thread starvation from flood attacks targeting the
binder interceptor with oversized payloads.
---
 app/src/main/cpp/binder_interceptor.cpp | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/src/main/cpp/binder_interceptor.cpp b/app/src/main/cpp/binder_interceptor.cpp
index ef84319..b602732 100644
--- a/app/src/main/cpp/binder_interceptor.cpp
+++ b/app/src/main/cpp/binder_interceptor.cpp
@@ -348,15 +348,16 @@ static sp<BinderStub> g_stub_instance = nullptr;
 
 namespace {
 
-/**
- * @brief Analyses a binder transaction. If the target is monitored,
- *        hijacks the transaction by rewriting its destination to our BinderStub.
- * @param txn_data Pointer to the transaction data within the ioctl buffer.
- */
+constexpr binder_size_t kMaxInterceptableDataSize = 256 * 1024;
+
 void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
     if (!txn_data || txn_data->target.ptr == 0)
         return;
 
+    // Bypass interception for oversized payloads to prevent thread starvation from flood attacks
+    if (txn_data->data_size > kMaxInterceptableDataSize)
+        return;
+
     bool hijack = false;
     ThreadTransactionInfo info;