Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0ac4e1a authored by Stephen Hines's avatar Stephen Hines
Browse files

Fix stack-use-after-scope for a `std::string` 

`android::util::Utf16ToUtf8()` actually returns a `std::string` due to
the actual conversion to Utf8. `ParseResourceNamedType()` operates on a
`StringPiece` of `converted` (the `std::string` returned from that
call), and stashes it away for later use. Of course, by the time we're
using the `StringPiece` in `parsed_type`, `converted` has already gone
out of scope and is invalid to access.

Bug: http://b/250827883
Test: ./art/test/testrunner/run_build_test_target.py -j80 art-asan
Merged-In: Iea71a5cc84b7dfa96e7dcb549435f8394770a4df
Change-Id: Ie03aa417c56df5cedd58bf0b32994d6b4e5395b4
parent 8c10dbf8

tools/aapt2/ResourceUtils.cpp

+6 −3
Original line number Original line Diff line number Diff line
@@ -51,8 +51,10 @@ std::optional<ResourceName> ToResourceName(const android::ResTable::resource_nam 
      util::Utf16ToUtf8(StringPiece16(name_in.package, name_in.packageLen));

      util::Utf16ToUtf8(StringPiece16(name_in.package, name_in.packageLen));





  std::optional<ResourceNamedTypeRef> type;

  std::optional<ResourceNamedTypeRef> type;

  std::string converted;

  if (name_in.type) {

  if (name_in.type) {

    type = ParseResourceNamedType(util::Utf16ToUtf8(StringPiece16(name_in.type, name_in.typeLen)));

    converted = util::Utf16ToUtf8(StringPiece16(name_in.type, name_in.typeLen));

    type = ParseResourceNamedType(converted);

  } else if (name_in.type8) {

  } else if (name_in.type8) {

    type = ParseResourceNamedType(StringPiece(name_in.type8, name_in.typeLen));

    type = ParseResourceNamedType(StringPiece(name_in.type8, name_in.typeLen));

  } else {

  } else {
@@ -85,9 +87,10 @@ std::optional<ResourceName> ToResourceName(const android::AssetManager2::Resourc 
  name_out.package = std::string(name_in.package, name_in.package_len);

  name_out.package = std::string(name_in.package, name_in.package_len);





  std::optional<ResourceNamedTypeRef> type;

  std::optional<ResourceNamedTypeRef> type;

  std::string converted;

  if (name_in.type16) {

  if (name_in.type16) {

    type =

    converted = util::Utf16ToUtf8(StringPiece16(name_in.type16, name_in.type_len));

        ParseResourceNamedType(util::Utf16ToUtf8(StringPiece16(name_in.type16, name_in.type_len)));

    type = ParseResourceNamedType(converted);

  } else if (name_in.type) {

  } else if (name_in.type) {

    type = ParseResourceNamedType(StringPiece(name_in.type, name_in.type_len));

    type = ParseResourceNamedType(StringPiece(name_in.type, name_in.type_len));

  } else {

  } else {