OSDN Git Service
(root)
/
android-x86
/
frameworks-native.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
b53300f
)
libbinder: readCString: no ubsan sub-overflow
author
Steven Moreland
<smoreland@google.com>
Fri, 17 May 2019 20:14:06 +0000
(13:14 -0700)
committer
Nikoli Cartagena
<dargeren@google.com>
Mon, 10 Jun 2019 21:06:51 +0000
(14:06 -0700)
Bug:
131859347
Test: fuzzer
Change-Id: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
Merged-In: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
(cherry picked from commit
d0d4b584fc294d2c124385644099852918416344
)
libs/binder/Parcel.cpp
patch
|
blob
|
history
diff --git
a/libs/binder/Parcel.cpp
b/libs/binder/Parcel.cpp
index
460bbe2
..
13555fd
100644
(file)
--- a/
libs/binder/Parcel.cpp
+++ b/
libs/binder/Parcel.cpp
@@
-2013,8
+2013,8
@@
status_t Parcel::readUtf8FromUtf16(std::unique_ptr<std::string>* str) const {
const char* Parcel::readCString() const
{
- const size_t avail = mDataSize-mDataPos;
- if (avail > 0) {
+ if (mDataPos < mDataSize) {
+ const size_t avail = mDataSize-mDataPos;
const char* str = reinterpret_cast<const char*>(mData+mDataPos);
// is the string's trailing NUL within the parcel's valid bounds?
const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));