OSDN Git Service

Fix temporary file name strlcpy size.
authorIvan Lozano <ivanlozano@google.com>
Fri, 15 Dec 2017 03:03:56 +0000 (19:03 -0800)
committerIvan Lozano <ivanlozano@google.com>
Thu, 21 Dec 2017 16:15:35 +0000 (08:15 -0800)
commit7f71764ce62fbb71f0ffc89ce9271115935fe240
tree97b4d46636fcba16af175de99e34d2a3375a4315
parent71b25c06a75ef54818dc9986f530f02580ac51e4
Fix temporary file name strlcpy size.

The strlcpy size argument overflows on integer sanitized builds.

 runtime error: unsigned integer overflow: 11 - 35 cannot be represented
 in type 'unsigned long'

This doesn't cause a problem because strlcpy stops on the null in
TMP_FILE_PATTERN, and localTmpFileName is defined large enough to
contain TMP_FILE_PATTERN.

This changes the size argument to the remaining length in the buffer,
and removes an extraneous '/' write as TMP_FILE_PATTERN already begins
with '/'.

Bug: 30969751
Test: Reran CTS test which triggered the overflow.

Change-Id: I20b5deeaaa1a863324dfd1d94f3135920eae48d3
Merged-In: I20b5deeaaa1a863324dfd1d94f3135920eae48d2
(cherry picked from commit 62fc14894b32f35641ae2b61ef7ed054c9660288)
core/jni/com_android_internal_content_NativeLibraryHelper.cpp