Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d682ddf2 authored by Sun Junwen's avatar Sun Junwen Committed by Steve Kondik
Browse files

Fix very long app_name crash. 

http://ibrahimbalic.com/2014/android-os-memory-corruption-bug/ found an stack overflow bug.
The very long app_name make libandroid_runtime allocate a very large array on stack, the stack may overflow to other data areas in this situation.
This patch allocate large array on heap instead of on stack to avoid segment fault when doing memcpy.

Change-Id: I99999569b852d43a9c7a6eb1fa80e9f1a1f4e2b2
parent 6d3ba52a

core/jni/android/graphics/Paint.cpp

+7 −2
Original line number Diff line number Diff line
@@ -565,7 +565,7 @@ public: 
                return 0;

            }

        }

        jfloat advancesArray[count];

        jfloat *advancesArray = new jfloat[count];

        jfloat totalAdvance = 0;



        TextLayout::getTextRunAdvances(paint, text, start, count, contextCount, flags,
@@ -574,6 +574,9 @@ public: 
        if (advances != NULL) {

            env->SetFloatArrayRegion(advances, advancesIndex, count, advancesArray);

        }



        delete [] advancesArray;



        return totalAdvance;

    }
@@ -600,7 +603,7 @@ public: 


    static jint doTextRunCursor(JNIEnv *env, SkPaint* paint, const jchar *text, jint start,

            jint count, jint flags, jint offset, jint opt) {

        jfloat scalarArray[count];

        jfloat *scalarArray = new jfloat[count];



        TextLayout::getTextRunAdvances(paint, text, start, count, start + count, flags,

                scalarArray, NULL /* dont need totalAdvance */);
@@ -639,6 +642,8 @@ public: 
          pos += start;

        }



        delete [] scalarArray;



        return pos;

    }