commit abe62623840ddb4fddbd03ac90f33eaee083066f
author TreeHugger Robot <treehugger-gerrit@google.com> Thu Jul 30 21:34:33 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Jul 30 21:34:33 2020 +0000
tree 5074b41ddd0c93b1023cd8832bd0db2942b06106
parent 1147253d8408679b915a1007137547772d50e47a
parent ca2b34c5923aca34cb425c232d2eb29110a186de

Merge "Fail explicitly on length overflow." into qt-qpr1-dev

libutils/FileMap.cpp

diff --git a/libutils/FileMap.cpp b/libutils/FileMap.cpp
index 1202c15..c828631 100644
--- a/libutils/FileMap.cpp
+++ b/libutils/FileMap.cpp
@@ -189,7 +189,11 @@
 
     int adjust = offset % mPageSize;
     off64_t adjOffset = offset - adjust;
-    size_t adjLength = length + adjust;
+    size_t adjLength;
+    if (__builtin_add_overflow(length, adjust, &adjLength)) {
+        ALOGE("adjusted length overflow: length %zu adjust %d", length, adjust);
+        return false;
+    }
 
     int flags = MAP_SHARED;
     int prot = PROT_READ;

libutils/FileMap_test.cpp

diff --git a/libutils/FileMap_test.cpp b/libutils/FileMap_test.cpp
index 576d89b..096e27a 100644
--- a/libutils/FileMap_test.cpp
+++ b/libutils/FileMap_test.cpp
@@ -32,3 +32,16 @@
     ASSERT_EQ(0u, m.getDataLength());
     ASSERT_EQ(4096, m.getDataOffset());
 }
+
+TEST(FileMap, offset_overflow) {
+    // Make sure that an end that overflows SIZE_MAX will not abort.
+    // See http://b/156997193.
+    TemporaryFile tf;
+    ASSERT_TRUE(tf.fd != -1);
+
+    off64_t offset = 200;
+    size_t length = SIZE_MAX;
+
+    android::FileMap m;
+    ASSERT_FALSE(m.create("test", tf.fd, offset, length, true));
+}