commit 186863ce49ef8ba6b62844ca9a2b9fa61a01fdf1
author Steven Moreland <smoreland@google.com> Tue Aug 04 23:02:18 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Aug 04 23:02:18 2020 +0000
tree c443e46e75dd5b3deaf225410c8ac3e2b506611b
parent e9aa43eb936c60803f98d8c7609f1b92d0304cc9
parent 4acfae954b4f0aab240ac9eb67507eb2f3ade23c

Merge "libutils: check vsnprintf error" into oc-dev am: a03d37d542 am: d8801aaad8 am: d05ecb8d9d am: dc99a094dd am: 64b312bbd8

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/core/+/12254459

Change-Id: I7d40bc3c63aa13c4050662f17b8a0854f8864ce4

libutils/String8.cpp

diff --git a/libutils/String8.cpp b/libutils/String8.cpp
index 0025c56..81ec598 100644
--- a/libutils/String8.cpp
+++ b/libutils/String8.cpp
@@ -322,8 +322,14 @@
     n = vsnprintf(nullptr, 0, fmt, tmp_args);
     va_end(tmp_args);
 
-    if (n != 0) {
+    if (n < 0) return UNKNOWN_ERROR;
+
+    if (n > 0) {
         size_t oldLength = length();
+        if ((size_t)n > SIZE_MAX - 1 ||
+            oldLength > SIZE_MAX - (size_t)n - 1) {
+            return NO_MEMORY;
+        }
         char* buf = lockBuffer(oldLength + n);
         if (buf) {
             vsnprintf(buf + oldLength, n + 1, fmt, args);