Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4cb70df authored by Yifan Hong's avatar Yifan Hong
Browse files

lshal: Fix empty hidl_array access. 

Fix this error:
  Abort message: 'Check failed: bytes != nullptr || len == 0 0x0 32'

This bug is introduced by the change below.
!hashRet.isOk() should have a break; in it like the other error cases.
The change below added this code after the error which used to be
the end of the statement.

Bug: 329190736
Fixes: b670dd7e
  ("lshal: Fix mem invalid access (timeoutIPC callers)")
Test: TH
Change-Id: Iada52b2ca033105962727fcccf651fbb5bdd5736
parent 30ad90f3

cmds/lshal/ListCommand.cpp

+4 −3
Original line number Diff line number Diff line
@@ -731,16 +731,17 @@ Status ListCommand::fetchBinderizedEntry(const sp<IServiceManager> &manager, 
                                  [hashChain](const auto& ret) { *hashChain = std::move(ret); });

        if (!hashRet.isOk()) {

            handleError(TRANSACTION_ERROR, "getHashChain failed: " + hashRet.description());

            break; // skip getHashChain

        }

        if (static_cast<size_t>(hashIndex) >= hashChain->size()) {

            handleError(BAD_IMPL,

                        "interfaceChain indicates position " + std::to_string(hashIndex) +

                                " but getHashChain returns " + std::to_string(hashChain->size()) +

                                " hashes");

        } else {

            break; // skip getHashChain

        }

        auto&& hashArray = (*hashChain)[hashIndex];

        entry->hash = android::base::HexString(hashArray.data(), hashArray.size());

        }

    } while (0);

    if (status == OK) {

        entry->serviceStatus = ServiceStatus::ALIVE;