Commit c26a5092 authored Apr 14, 2020 by Stephen Crane

Fix out-of-bounds write past end of buckets on long transactions

For some values of max_time_bucket, (max_time_bucket-1) /
time_per_bucket will end up being num_buckets, which is one element past
the end of the buckets array.

Test: adb shell binderThroughputTest -- -m 500

Change-Id: Ie3933df6e563854b375604368c06dbd33697250a

parent e5c824b2

libs/binder/tests/binderThroughputTest.cpp

+1 −1

Original line number	Diff line number	Diff line
		@@ -116,7 +116,7 @@ struct ProcResults {
		if (time > max_time_bucket) {
		m_long_transactions++;
		}
		m_buckets[min(time, max_time_bucket-1) / time_per_bucket] += 1;
		m_buckets[min((uint32_t)(time / time_per_bucket), num_buckets - 1)] += 1;
		m_best = min(time, m_best);
		m_worst = max(time, m_worst);
		m_transactions += 1;