diff options
| author | Steven Moreland <smoreland@google.com> | 2020-08-04 23:02:18 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-08-04 23:02:18 +0000 |
| commit | 0cb14f1fe7b1f63de2d697797a1e101724f7be40 (patch) | |
| tree | c443e46e75dd5b3deaf225410c8ac3e2b506611b | |
| parent | 2384ca2ae572d99fd51ae82f1561e0caadd23380 (diff) | |
| parent | 64b312bbd80c02157b795b703c61a468a259eddc (diff) | |
| download | core-0cb14f1fe7b1f63de2d697797a1e101724f7be40.tar.gz | |
Merge "libutils: check vsnprintf error" into oc-dev am: a03d37d542 am: d8801aaad8 am: d05ecb8d9d am: dc99a094dd am: 64b312bbd8
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/core/+/12254459
Change-Id: I7d40bc3c63aa13c4050662f17b8a0854f8864ce4
| -rw-r--r-- | libutils/String8.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libutils/String8.cpp b/libutils/String8.cpp index 0025c5648..81ec598c3 100644 --- a/libutils/String8.cpp +++ b/libutils/String8.cpp @@ -322,8 +322,14 @@ status_t String8::appendFormatV(const char* fmt, va_list args) n = vsnprintf(nullptr, 0, fmt, tmp_args); va_end(tmp_args); - if (n != 0) { + if (n < 0) return UNKNOWN_ERROR; + + if (n > 0) { size_t oldLength = length(); + if ((size_t)n > SIZE_MAX - 1 || + oldLength > SIZE_MAX - (size_t)n - 1) { + return NO_MEMORY; + } char* buf = lockBuffer(oldLength + n); if (buf) { vsnprintf(buf + oldLength, n + 1, fmt, args); |