Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d9ff77fa authored by Jeff Sharkey's avatar Jeff Sharkey
Browse files

Fix use-after-free issue caught by ASAN. 

Keep strong references to std::string objects around while we're
actively using them in fts_open().

Test: builds, boots
Bug: 36975037
Change-Id: Icd7cba5852a01f0a1015e7d0d7dcd3087fa44ae8
parent 11c1acc3

cmds/installd/InstalldNativeService.cpp

+6 −10
Original line number Diff line number Diff line
@@ -617,11 +617,9 @@ binder::Status InstalldNativeService::fixupAppData(const std::unique_ptr<std::st 
        ATRACE_BEGIN("fixup user");

        FTS* fts;

        FTSENT* p;

        char *argv[] = {

                (char*) create_data_user_ce_path(uuid_, user).c_str(),

                (char*) create_data_user_de_path(uuid_, user).c_str(),

                nullptr

        };

        auto ce_path = create_data_user_ce_path(uuid_, user);

        auto de_path = create_data_user_de_path(uuid_, user);

        char *argv[] = { (char*) ce_path.c_str(), (char*) de_path.c_str(), nullptr };

        if (!(fts = fts_open(argv, FTS_PHYSICAL | FTS_NOCHDIR | FTS_XDEV, NULL))) {

            return error("Failed to fts_open");

        }
@@ -950,11 +948,9 @@ binder::Status InstalldNativeService::freeCache(const std::unique_ptr<std::strin 
        for (auto user : get_known_users(uuid_)) {

            FTS *fts;

            FTSENT *p;

            char *argv[] = {

                    (char*) create_data_user_ce_path(uuid_, user).c_str(),

                    (char*) create_data_user_de_path(uuid_, user).c_str(),

                    nullptr

            };

            auto ce_path = create_data_user_ce_path(uuid_, user);

            auto de_path = create_data_user_de_path(uuid_, user);

            char *argv[] = { (char*) ce_path.c_str(), (char*) de_path.c_str(), nullptr };

            if (!(fts = fts_open(argv, FTS_PHYSICAL | FTS_NOCHDIR | FTS_XDEV, NULL))) {

                return error("Failed to fts_open");

            }