commit d8cc875de93d32176fa858ff47f76e1d78627fae
author Evgenii Stepanov <eugenis@google.com> Tue Mar 14 14:47:25 2017 -0700
committer Evgenii Stepanov <eugenis@google.com> Tue Mar 14 14:47:25 2017 -0700
tree acd88def30dfd21c67d7a4e54fd4f6496cf29b7c
parent 4f2e465dc6b98c21fbb8a7a941918246d467a61f

Fix heap-buffer-overflow detected by ASAN.

Bug: 34949125
Bug: 34606909
Test: Make sure Android boots when built with SANITIZE_TARGET='address'
Change-Id: I9c004e806f2025098aa72228284b05affd2c2802

logd/LogBuffer.cpp

diff --git a/logd/LogBuffer.cpp b/logd/LogBuffer.cpp
index 9c634f6..2b6c276 100644
--- a/logd/LogBuffer.cpp
+++ b/logd/LogBuffer.cpp
@@ -180,8 +180,13 @@
     if (!avcr) return DIFFERENT;
     lenr -= avcr - msgr;
     if (lenl != lenr) return DIFFERENT;
-    if (fastcmp<memcmp>(avcl + strlen(avc), avcr + strlen(avc), lenl))
+    // TODO: After b/35468874 is addressed, revisit "lenl > strlen(avc)"
+    // condition, it might become superflous.
+    if (lenl > strlen(avc) &&
+        fastcmp<memcmp>(avcl + strlen(avc), avcr + strlen(avc),
+                        lenl - strlen(avc))) {
         return DIFFERENT;
+    }
     return SAME;
 }