Merge "Prevent integer overflow when allocating native_handle_t" into mnc-dev
diff --git a/adb/adb_utils.cpp b/adb/adb_utils.cpp
index 0ce5ece..604bd57 100644
--- a/adb/adb_utils.cpp
+++ b/adb/adb_utils.cpp
@@ -45,11 +45,16 @@
std::string escape_arg(const std::string& s) {
std::string result = s;
- // Insert a \ before any ' in the string.
- for (auto it = result.begin(); it != result.end(); ++it) {
- if (*it == '\'') {
- it = result.insert(it, '\\') + 1;
- }
+ // Escape any ' in the string (before we single-quote the whole thing).
+ // The correct way to do this for the shell is to replace ' with '\'' --- that is,
+ // close the existing single-quoted string, escape a single single-quote, and start
+ // a new single-quoted string. Like the C preprocessor, the shell will concatenate
+ // these pieces into one string.
+ for (size_t i = 0; i < s.size(); ++i) {
+ if (s[i] == '\'') {
+ result.insert(i, "'\\'");
+ i += 2;
+ }
}
// Prefix and suffix the whole string with '.
diff --git a/adb/adb_utils_test.cpp b/adb/adb_utils_test.cpp
index a395079..052aea5 100644
--- a/adb/adb_utils_test.cpp
+++ b/adb/adb_utils_test.cpp
@@ -30,21 +30,21 @@
ASSERT_EQ(R"('abc')", escape_arg("abc"));
ASSERT_EQ(R"(' abc')", escape_arg(" abc"));
- ASSERT_EQ(R"('\'abc')", escape_arg("'abc"));
+ ASSERT_EQ(R"(''\''abc')", escape_arg("'abc"));
ASSERT_EQ(R"('"abc')", escape_arg("\"abc"));
ASSERT_EQ(R"('\abc')", escape_arg("\\abc"));
ASSERT_EQ(R"('(abc')", escape_arg("(abc"));
ASSERT_EQ(R"(')abc')", escape_arg(")abc"));
ASSERT_EQ(R"('abc abc')", escape_arg("abc abc"));
- ASSERT_EQ(R"('abc\'abc')", escape_arg("abc'abc"));
+ ASSERT_EQ(R"('abc'\''abc')", escape_arg("abc'abc"));
ASSERT_EQ(R"('abc"abc')", escape_arg("abc\"abc"));
ASSERT_EQ(R"('abc\abc')", escape_arg("abc\\abc"));
ASSERT_EQ(R"('abc(abc')", escape_arg("abc(abc"));
ASSERT_EQ(R"('abc)abc')", escape_arg("abc)abc"));
ASSERT_EQ(R"('abc ')", escape_arg("abc "));
- ASSERT_EQ(R"('abc\'')", escape_arg("abc'"));
+ ASSERT_EQ(R"('abc'\''')", escape_arg("abc'"));
ASSERT_EQ(R"('abc"')", escape_arg("abc\""));
ASSERT_EQ(R"('abc\')", escape_arg("abc\\"));
ASSERT_EQ(R"('abc(')", escape_arg("abc("));
diff --git a/adb/tests/test_adb.py b/adb/tests/test_adb.py
index 237ef47..0ff87d2 100755
--- a/adb/tests/test_adb.py
+++ b/adb/tests/test_adb.py
@@ -6,6 +6,7 @@
"""
import hashlib
import os
+import pipes
import random
import re
import shlex
@@ -162,6 +163,9 @@
def shell_nocheck(self, cmd):
return call_combined(self.adb_cmd + "shell " + cmd)
+ def install(self, filename):
+ return call_checked(self.adb_cmd + "install {}".format(pipes.quote(filename)))
+
def push(self, local, remote):
return call_checked(self.adb_cmd + "push {} {}".format(local, remote))
@@ -290,6 +294,18 @@
self.assertEqual('t', adb.shell("FOO=a BAR=b echo t").strip())
self.assertEqual('123Linux', adb.shell("echo -n 123\;uname").strip())
+ def test_install_argument_escaping(self):
+ """Make sure that install argument escaping works."""
+ adb = AdbWrapper()
+
+ # http://b/20323053
+ tf = tempfile.NamedTemporaryFile("w", suffix="-text;ls;1.apk")
+ self.assertIn("-text;ls;1.apk", adb.install(tf.name))
+
+ # http://b/3090932
+ tf = tempfile.NamedTemporaryFile("w", suffix="-Live Hold'em.apk")
+ self.assertIn("-Live Hold'em.apk", adb.install(tf.name))
+
class AdbFile(unittest.TestCase):
SCRATCH_DIR = "/data/local/tmp"
diff --git a/debuggerd/backtrace.cpp b/debuggerd/backtrace.cpp
index 79ee4e5..b8084c5 100644
--- a/debuggerd/backtrace.cpp
+++ b/debuggerd/backtrace.cpp
@@ -28,10 +28,11 @@
#include <sys/types.h>
#include <sys/ptrace.h>
+#include <memory>
+
#include <backtrace/Backtrace.h>
#include <log/log.h>
-#include <UniquePtr.h>
#include "backtrace.h"
@@ -96,7 +97,7 @@
return;
}
- UniquePtr<Backtrace> backtrace(Backtrace::Create(tid, BACKTRACE_CURRENT_THREAD));
+ std::unique_ptr<Backtrace> backtrace(Backtrace::Create(tid, BACKTRACE_CURRENT_THREAD));
if (backtrace->Unwind(0)) {
dump_backtrace_to_log(backtrace.get(), log, " ");
} else {
diff --git a/debuggerd/tombstone.cpp b/debuggerd/tombstone.cpp
index 4c804ee..ccdfe85 100644
--- a/debuggerd/tombstone.cpp
+++ b/debuggerd/tombstone.cpp
@@ -32,6 +32,9 @@
#include <sys/stat.h>
#include <sys/un.h>
+#include <memory>
+#include <string>
+
#include <private/android_filesystem_config.h>
#include <base/stringprintf.h>
@@ -45,10 +48,6 @@
#include <selinux/android.h>
-#include <UniquePtr.h>
-
-#include <string>
-
#include "backtrace.h"
#include "elf_utils.h"
#include "machine.h"
@@ -445,7 +444,7 @@
dump_thread_info(log, pid, new_tid);
dump_registers(log, new_tid);
- UniquePtr<Backtrace> backtrace(Backtrace::Create(pid, new_tid, map));
+ std::unique_ptr<Backtrace> backtrace(Backtrace::Create(pid, new_tid, map));
if (backtrace->Unwind(0)) {
dump_backtrace_and_stack(backtrace.get(), log);
} else {
@@ -646,8 +645,8 @@
dump_signal_info(log, tid, signal, si_code);
}
- UniquePtr<BacktraceMap> map(BacktraceMap::Create(pid));
- UniquePtr<Backtrace> backtrace(Backtrace::Create(pid, tid, map.get()));
+ std::unique_ptr<BacktraceMap> map(BacktraceMap::Create(pid));
+ std::unique_ptr<Backtrace> backtrace(Backtrace::Create(pid, tid, map.get()));
dump_abort_message(backtrace.get(), log, abort_msg_address);
dump_registers(log, tid);
if (backtrace->Unwind(0)) {
diff --git a/init/init.cpp b/init/init.cpp
index dd74538..5185f77 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -618,7 +618,10 @@
Timer t;
NOTICE("Waiting for %s...\n", COLDBOOT_DONE);
- if (wait_for_file(COLDBOOT_DONE, COMMAND_RETRY_TIMEOUT)) {
+ // Any longer than 1s is an unreasonable length of time to delay booting.
+ // If you're hitting this timeout, check that you didn't make your
+ // sepolicy regular expressions too expensive (http://b/19899875).
+ if (wait_for_file(COLDBOOT_DONE, 1)) {
ERROR("Timed out waiting for %s\n", COLDBOOT_DONE);
}
diff --git a/libmincrypt/Android.mk b/libmincrypt/Android.mk
index 503bcb4..7906986 100644
--- a/libmincrypt/Android.mk
+++ b/libmincrypt/Android.mk
@@ -6,8 +6,6 @@
LOCAL_MODULE := libmincrypt
LOCAL_SRC_FILES := dsa_sig.c p256.c p256_ec.c p256_ecdsa.c rsa.c sha.c sha256.c
LOCAL_CFLAGS := -Wall -Werror
-# Clang's slp-vectorize phase has segmentation fault when compiling p256_ec.c.
-LOCAL_CLANG_CFLAGS += -fno-slp-vectorize
include $(BUILD_STATIC_LIBRARY)
include $(CLEAR_VARS)
diff --git a/libsuspend/autosuspend_autosleep.c b/libsuspend/autosuspend_autosleep.c
index 0d31e74..7262cc7 100644
--- a/libsuspend/autosuspend_autosleep.c
+++ b/libsuspend/autosuspend_autosleep.c
@@ -40,7 +40,7 @@
ALOGV("autosuspend_autosleep_enable\n");
- ret = write(autosleep_fd, sleep_state, strlen(sleep_state));
+ ret = TEMP_FAILURE_RETRY(write(autosleep_fd, sleep_state, strlen(sleep_state)));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error writing to %s: %s\n", SYS_POWER_AUTOSLEEP, buf);
@@ -62,7 +62,7 @@
ALOGV("autosuspend_autosleep_disable\n");
- ret = write(autosleep_fd, on_state, strlen(on_state));
+ ret = TEMP_FAILURE_RETRY(write(autosleep_fd, on_state, strlen(on_state)));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error writing to %s: %s\n", SYS_POWER_AUTOSLEEP, buf);
@@ -86,7 +86,7 @@
{
char buf[80];
- autosleep_fd = open(SYS_POWER_AUTOSLEEP, O_WRONLY);
+ autosleep_fd = TEMP_FAILURE_RETRY(open(SYS_POWER_AUTOSLEEP, O_WRONLY));
if (autosleep_fd < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error opening %s: %s\n", SYS_POWER_AUTOSLEEP, buf);
diff --git a/libsuspend/autosuspend_earlysuspend.c b/libsuspend/autosuspend_earlysuspend.c
index 2bece4c..3793a69 100644
--- a/libsuspend/autosuspend_earlysuspend.c
+++ b/libsuspend/autosuspend_earlysuspend.c
@@ -49,11 +49,9 @@
{
int err = 0;
char buf;
- int fd = open(EARLYSUSPEND_WAIT_FOR_FB_WAKE, O_RDONLY, 0);
+ int fd = TEMP_FAILURE_RETRY(open(EARLYSUSPEND_WAIT_FOR_FB_WAKE, O_RDONLY, 0));
// if the file doesn't exist, the error will be caught in read() below
- do {
- err = read(fd, &buf, 1);
- } while (err < 0 && errno == EINTR);
+ err = TEMP_FAILURE_RETRY(read(fd, &buf, 1));
ALOGE_IF(err < 0,
"*** ANDROID_WAIT_FOR_FB_WAKE failed (%s)", strerror(errno));
close(fd);
@@ -64,11 +62,9 @@
{
int err = 0;
char buf;
- int fd = open(EARLYSUSPEND_WAIT_FOR_FB_SLEEP, O_RDONLY, 0);
+ int fd = TEMP_FAILURE_RETRY(open(EARLYSUSPEND_WAIT_FOR_FB_SLEEP, O_RDONLY, 0));
// if the file doesn't exist, the error will be caught in read() below
- do {
- err = read(fd, &buf, 1);
- } while (err < 0 && errno == EINTR);
+ err = TEMP_FAILURE_RETRY(read(fd, &buf, 1));
ALOGE_IF(err < 0,
"*** ANDROID_WAIT_FOR_FB_SLEEP failed (%s)", strerror(errno));
close(fd);
@@ -134,7 +130,7 @@
ALOGV("autosuspend_earlysuspend_disable\n");
- ret = write(sPowerStatefd, pwr_state_on, strlen(pwr_state_on));
+ ret = TEMP_FAILURE_RETRY(write(sPowerStatefd, pwr_state_on, strlen(pwr_state_on)));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error writing to %s: %s\n", EARLYSUSPEND_SYS_POWER_STATE, buf);
@@ -195,7 +191,7 @@
char buf[80];
int ret;
- sPowerStatefd = open(EARLYSUSPEND_SYS_POWER_STATE, O_RDWR);
+ sPowerStatefd = TEMP_FAILURE_RETRY(open(EARLYSUSPEND_SYS_POWER_STATE, O_RDWR));
if (sPowerStatefd < 0) {
strerror_r(errno, buf, sizeof(buf));
@@ -203,7 +199,7 @@
return NULL;
}
- ret = write(sPowerStatefd, "on", 2);
+ ret = TEMP_FAILURE_RETRY(write(sPowerStatefd, "on", 2));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGW("Error writing 'on' to %s: %s\n", EARLYSUSPEND_SYS_POWER_STATE, buf);
diff --git a/libsuspend/autosuspend_wakeup_count.c b/libsuspend/autosuspend_wakeup_count.c
index 7483a8f..ee4ebe7 100644
--- a/libsuspend/autosuspend_wakeup_count.c
+++ b/libsuspend/autosuspend_wakeup_count.c
@@ -51,7 +51,8 @@
usleep(100000);
ALOGV("%s: read wakeup_count\n", __func__);
lseek(wakeup_count_fd, 0, SEEK_SET);
- wakeup_count_len = read(wakeup_count_fd, wakeup_count, sizeof(wakeup_count));
+ wakeup_count_len = TEMP_FAILURE_RETRY(read(wakeup_count_fd, wakeup_count,
+ sizeof(wakeup_count)));
if (wakeup_count_len < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error reading from %s: %s\n", SYS_POWER_WAKEUP_COUNT, buf);
@@ -72,13 +73,13 @@
}
ALOGV("%s: write %*s to wakeup_count\n", __func__, wakeup_count_len, wakeup_count);
- ret = write(wakeup_count_fd, wakeup_count, wakeup_count_len);
+ ret = TEMP_FAILURE_RETRY(write(wakeup_count_fd, wakeup_count, wakeup_count_len));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error writing to %s: %s\n", SYS_POWER_WAKEUP_COUNT, buf);
} else {
ALOGV("%s: write %s to %s\n", __func__, sleep_state, SYS_POWER_STATE);
- ret = write(state_fd, sleep_state, strlen(sleep_state));
+ ret = TEMP_FAILURE_RETRY(write(state_fd, sleep_state, strlen(sleep_state)));
if (ret < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error writing to %s: %s\n", SYS_POWER_STATE, buf);
@@ -157,14 +158,14 @@
int ret;
char buf[80];
- state_fd = open(SYS_POWER_STATE, O_RDWR);
+ state_fd = TEMP_FAILURE_RETRY(open(SYS_POWER_STATE, O_RDWR));
if (state_fd < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error opening %s: %s\n", SYS_POWER_STATE, buf);
goto err_open_state;
}
- wakeup_count_fd = open(SYS_POWER_WAKEUP_COUNT, O_RDWR);
+ wakeup_count_fd = TEMP_FAILURE_RETRY(open(SYS_POWER_WAKEUP_COUNT, O_RDWR));
if (wakeup_count_fd < 0) {
strerror_r(errno, buf, sizeof(buf));
ALOGE("Error opening %s: %s\n", SYS_POWER_WAKEUP_COUNT, buf);