Merge "Enforce null-termination in ResStringPool::stringAt" (1808d437) · Commits · e / os / android_frameworks_base

libs/androidfw/ResourceTypes.cpp

+13 −0

Original line number	Diff line number	Diff line
		@@ -701,6 +701,12 @@ const char16_t* ResStringPool::stringAt(size_t idx, size_t* u16len) const

		*u16len = decodeLength(&str);
		if ((uint32_t)(str+*u16len-strings) < mStringPoolSize) {
		// Reject malformed (non null-terminated) strings
		if (str[*u16len] != 0x0000) {
		ALOGW("Bad string block: string #%d is not null-terminated",
		(int)idx);
		return NULL;
		}
		return reinterpret_cast<const char16_t*>(str);
		} else {
		ALOGW("Bad string block: string #%d extends to %d, past end at %d\n",
		@@ -748,6 +754,13 @@ const char16_t* ResStringPool::stringAt(size_t idx, size_t* u16len) const
		return NULL;
		}

		// Reject malformed (non null-terminated) strings
		if (u8str[u8len] != 0x00) {
		ALOGW("Bad string block: string #%d is not null-terminated",
		(int)idx);
		return NULL;
		}

		char16_t u16str = (char16_t )calloc(*u16len+1, sizeof(char16_t));
		if (!u16str) {
		ALOGW("No memory when trying to allocate decode cache for string #%d\n",