| commit | 4acfae954b4f0aab240ac9eb67507eb2f3ade23c | [log] [tgz] |
|---|---|---|
| author | Steven Moreland <smoreland@google.com> | Tue Aug 04 22:46:49 2020 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Aug 04 22:46:49 2020 +0000 |
| tree | a15ab52b2570a8e5f2606a043b9c935bf38d1a5a | |
| parent | 678c75b310e7377a458fc54aa224557a7a19c3e2 [diff] | |
| parent | d36aba18e5eae358beed20ec291287dc62f4c0fb [diff] |
Merge "libutils: check vsnprintf error" into oc-dev am: a03d37d542 am: d8801aaad8 am: d05ecb8d9d am: dc99a094dd Original change: https://googleplex-android-review.googlesource.com/c/platform/system/core/+/12254459 Change-Id: I79dcbb310a2515e7f17ad2ebbb0367070084dab2
diff --git a/libutils/String8.cpp b/libutils/String8.cpp index 0025c56..81ec598 100644 --- a/libutils/String8.cpp +++ b/libutils/String8.cpp
@@ -322,8 +322,14 @@ n = vsnprintf(nullptr, 0, fmt, tmp_args); va_end(tmp_args); - if (n != 0) { + if (n < 0) return UNKNOWN_ERROR; + + if (n > 0) { size_t oldLength = length(); + if ((size_t)n > SIZE_MAX - 1 || + oldLength > SIZE_MAX - (size_t)n - 1) { + return NO_MEMORY; + } char* buf = lockBuffer(oldLength + n); if (buf) { vsnprintf(buf + oldLength, n + 1, fmt, args);