commit c44772fdd289b8b0ec9dab562bd2d3938c81477e
author Christopher Ferris <cferris@google.com> Tue May 26 10:33:18 2020 -0700
committer Christopher Ferris <cferris@google.com> Thu Jun 04 11:05:18 2020 -0700
tree a1247d4a856063b577e6ee1ccfaad4b64229d234
parent acea7c72cc317fff777777eec5475f3276646dcb

Fail explicitly on length overflow.

Instead of aborting when FileMap::create detects an overflow, detect the
overflow directly and fail the call.

Bug: 156997193

Test: Ran unit tests, including new unit test that aborted before.
Change-Id: Ie49975b8949fd12bbde14346ec9bbb774ef88a51
Merged-In: Ie49975b8949fd12bbde14346ec9bbb774ef88a51
(cherry picked from commit 68604b9c29b5bd11e2e2dbb848d6b364bf627d21)

libutils/FileMap.cpp

diff --git a/libutils/FileMap.cpp b/libutils/FileMap.cpp
index 1afa1ec..b9f411e 100644
--- a/libutils/FileMap.cpp
+++ b/libutils/FileMap.cpp
@@ -182,6 +182,10 @@
     adjust = offset % mPageSize;
     adjOffset = offset - adjust;
     adjLength = length + adjust;
+    if (__builtin_add_overflow(length, adjust, &adjLength)) {
+        ALOGE("adjusted length overflow: length %zu adjust %d", length, adjust);
+        return false;
+    }
 
     flags = MAP_SHARED;
     prot = PROT_READ;