Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ab69f0e authored by Linux Build Service Account's avatar Linux Build Service Account
Browse files

Promotion of android-framework.lnx.2.0-00011. 

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
1060185   I518e7b2fe10aaa3f1c1987586a09b1110aff7e1a   Add bound checks to utf16_to_utf8

Change-Id: I84da8049f79e80a433d808b725f7d5bf18a913c5
CRs-Fixed: 1060185
parents 1fc09b25 e01b89bb

libs/binder/Parcel.cpp

+6 −5
Original line number Diff line number Diff line
@@ -1795,15 +1795,16 @@ status_t Parcel::readUtf8FromUtf16(std::string* str) const { 
       return NO_ERROR;

    }



    ssize_t utf8Size = utf16_to_utf8_length(src, utf16Size);

    if (utf8Size < 0) {

    // Allow for closing '\0'

    ssize_t utf8Size = utf16_to_utf8_length(src, utf16Size) + 1;

    if (utf8Size < 1) {

        return BAD_VALUE;

    }

    // Note that while it is probably safe to assume string::resize keeps a

    // spare byte around for the trailing null, we're going to be explicit.

    str->resize(utf8Size + 1);

    utf16_to_utf8(src, utf16Size, &((*str)[0]));

    // spare byte around for the trailing null, we still pass the size including the trailing null

    str->resize(utf8Size);

    utf16_to_utf8(src, utf16Size, &((*str)[0]), utf8Size);

    str->resize(utf8Size - 1);

    return NO_ERROR;

}