Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cfe0d38f authored by Mallikarjuna Reddy Amireddy's avatar Mallikarjuna Reddy Amireddy Committed by Gerrit - the friendly Code Review server
Browse files

frameworks/base: fix: string out of boundary. 

String length should use GetStringLengh() and the resultant buffer
should be GetStringUTFLength(). So Update the code accordigly to
fix the string out of boundary.

Bug: 921692
Change-Id: I2c3d37ac713b2545e740787bdf1804e15c4c5be6
parent dfc3f6aa

core/jni/android_util_SeempLog.cpp

+3 −3
Original line number Diff line number Diff line
@@ -166,8 +166,8 @@ static jint android_util_SeempLog_println_native(JNIEnv* env, jobject clazz, 


    int  apiId    = (int)api;

    int  apiIdLen = sizeof(apiId);

    int  msgLen   = env->GetStringUTFLength(msgObj);

    int  len      = apiIdLen + 1 + msgLen + 1;

    int  utf8MsgLen   = env->GetStringUTFLength(msgObj);

    int  len      = apiIdLen + 1 + utf8MsgLen + 1;

    char *msg     = (char*)malloc(len);

    if ( NULL == msg )

    {
@@ -177,7 +177,7 @@ static jint android_util_SeempLog_println_native(JNIEnv* env, jobject clazz, 


    *((int*)msg)  = apiId;                              // copy api id

    //                                                  // skip encoding byte

    env->GetStringUTFRegion(msgObj, 0, msgLen, params); // copy message

    env->GetStringUTFRegion(msgObj, 0, env->GetStringLength(msgObj), params); // copy message

    msg[len - 1]  = 0;                                  // copy terminating zero



    int  res      = __android_seemp_socket_write(len, msg); // send message