| commit | d36aba18e5eae358beed20ec291287dc62f4c0fb | [log] [tgz] |
|---|---|---|
| author | Steven Moreland <smoreland@google.com> | Tue Aug 04 22:21:36 2020 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Aug 04 22:21:36 2020 +0000 |
| tree | 8f1f92ff892bb88cd3e92a443b3af8c0b78dfbc8 | |
| parent | 849e74b4c524e31f4abcba6c8057c51704ec3514 [diff] | |
| parent | 1c2859fb76bb4c4b2330585226cac43e1ac3f263 [diff] |
Merge "libutils: check vsnprintf error" into oc-dev am: a03d37d542 am: d8801aaad8 am: d05ecb8d9d Original change: https://googleplex-android-review.googlesource.com/c/platform/system/core/+/12254459 Change-Id: I816b8858c69e6481299f942401a16b5b39cd8b69
diff --git a/libutils/String8.cpp b/libutils/String8.cpp index ad0e72e..8f9c9f7 100644 --- a/libutils/String8.cpp +++ b/libutils/String8.cpp
@@ -346,8 +346,14 @@ n = vsnprintf(NULL, 0, fmt, tmp_args); va_end(tmp_args); - if (n != 0) { + if (n < 0) return UNKNOWN_ERROR; + + if (n > 0) { size_t oldLength = length(); + if ((size_t)n > SIZE_MAX - 1 || + oldLength > SIZE_MAX - (size_t)n - 1) { + return NO_MEMORY; + } char* buf = lockBuffer(oldLength + n); if (buf) { vsnprintf(buf + oldLength, n + 1, fmt, args);