commit ba95be58c596aa7b5034b1bce8f3fde97ae08780
author Christopher R. Palmer <crpalmer@gmail.com> Mon Sep 22 14:35:54 2014 -0400
committer Elliott Hughes <enh@google.com> Wed Jan 07 12:18:00 2015 -0800
tree 335caf206aab4331ce1c2bfdce329b814afc611f
parent 4fca59181c838b91572d1b57cb74b26d0a70528f

init: Fix memory corruption when sanitizing platform paths

This commit fixes code that incorrectly increments s when it
hits the terminator character of the string being sanitized.
This means it will randomly start trashing memory beyond the
end of the string being sanitized until it happens to hit two
NULs (\0\0) which will break it out of the loop.

(cherry picked from commit 07f3fee164bd7ba14ce9b2dd3818006f07162845)

Bug: 18885357
Change-Id: If6b01fe2b9bd5985f08f1278deb03b311d0170dc

init/util.c

diff --git a/init/util.c b/init/util.c
index 0f69e1c..e1a3ee3 100644
--- a/init/util.c
+++ b/init/util.c
@@ -329,9 +329,9 @@
     if (!s)
         return;
 
-    for (; *s; s++) {
+    while (*s) {
         s += strspn(s, accept);
-        if (*s) *s = '_';
+        if (*s) *s++ = '_';
     }
 }