| commit | a436694eafeceb7a8e7e2c0f177d053935989a40 | [log] [tgz] |
|---|---|---|
| author | Steven Moreland <smoreland@google.com> | Wed Aug 05 00:08:49 2020 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Aug 05 00:08:49 2020 +0000 |
| tree | 7b65f3b76e35f471c92daa304b0ab2f405a18579 | |
| parent | 340c2105e98e3b862edc381fa39117a9405a513d [diff] | |
| parent | bb34b0b398d116f22abea26c5902905afbf061db [diff] |
Merge "libutils: check vsnprintf error" into oc-dev am: a03d37d542 am: d8801aaad8 am: d05ecb8d9d am: dc99a094dd am: 64b312bbd8 am: 0cb14f1fe7 am: ce44c8ac3c am: 1db089dc83 Original change: https://googleplex-android-review.googlesource.com/c/platform/system/core/+/12254459 Change-Id: Id855ccb8767afbc80338315d8a0522054855a749
diff --git a/libutils/String8.cpp b/libutils/String8.cpp index d13548e..9d50e0b 100644 --- a/libutils/String8.cpp +++ b/libutils/String8.cpp
@@ -322,8 +322,14 @@ n = vsnprintf(nullptr, 0, fmt, tmp_args); va_end(tmp_args); - if (n != 0) { + if (n < 0) return UNKNOWN_ERROR; + + if (n > 0) { size_t oldLength = length(); + if ((size_t)n > SIZE_MAX - 1 || + oldLength > SIZE_MAX - (size_t)n - 1) { + return NO_MEMORY; + } char* buf = lockBuffer(oldLength + n); if (buf) { vsnprintf(buf + oldLength, n + 1, fmt, args);