Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7fd1b808 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Relax integer limits in argument handling of native Zygote loop" into...

Merge "Relax integer limits in argument handling of native Zygote loop" into main am: 7f97613f am: eb26374a

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/3493952



Change-Id: I90360ea60e11c31ca72d847a45d77b86c44a99a7
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 645a3995 eb26374a
Loading
Loading
Loading
Loading
+13 −5
Original line number Diff line number Diff line
@@ -266,16 +266,24 @@ class NativeCommandBuffer {
  }
  // Picky version of atoi(). No sign or unexpected characters allowed. Return -1 on failure.
  static int digitsVal(char* start, char* end) {
    constexpr int vmax = std::numeric_limits<int>::max();
    int result = 0;
    if (end - start > 6) {
      return -1;
    }
    for (char* dp = start; dp < end; ++dp) {
      if (*dp < '0' || *dp > '9') {
        ALOGW("Argument failed integer format check");
        ALOGW("Argument contains non-integer characters");
        return -1;
      }
      int digit = *dp - '0';
      if (result > vmax / 10) {
        ALOGW("Argument exceeds int limit");
        return -1;
      }
      result *= 10;
      if (result > vmax - digit) {
        ALOGW("Argument exceeds int limit");
        return -1;
      }
      result = 10 * result + (*dp - '0');
      result += digit;
    }
    return result;
  }