commit 3b0abc441bac16d0bfdee5e798a4fcf793b9ee70
author Steven Moreland <smoreland@google.com> Thu May 28 00:29:08 2020 +0000
committer Steven Moreland <smoreland@google.com> Thu May 28 20:45:55 2020 +0000
tree 6c8a3f0e21f3937801a0b369e1311fbc1ee277a1
parent acea7c72cc317fff777777eec5475f3276646dcb

String16::remove - avoid overflow

Bug: 156999009
Test: libutils_test (cases added)
Change-Id: Iad46d95d9848928ba81000090b2fe9aec1e5eaac
Merged-In: Iad46d95d9848928ba81000090b2fe9aec1e5eaac
(cherry picked from commit f251c1c581f2d1b9940e60e756315c5e15443990)
(cherry picked from commit 9a9c8910e9296c9dc8d79c37f589895f5a2a836c)

libutils/String16.cpp

diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index e8f1c51..7055fc6 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -402,7 +402,7 @@
         mString = getEmptyString();
         return NO_ERROR;
     }
-    if ((begin+len) > N) len = N-begin;
+    if (len > N || len > N - begin) len = N - begin;
     if (begin == 0 && len == N) {
         return NO_ERROR;
     }