Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db95abe4 authored by Jeremy Wu's avatar Jeremy Wu
Browse files

StopWatchLegacy: fix OOB array access in |RecordLog| 

|current_buffer_index| does not guarantee to be less than
|LOG_BUFFER_LENGTH| on read.

Bug: 364491209
Bug: 349290628
Flag: EXEMPT, obvious and risk-free bug fix
Test: m Bluetooth
Change-Id: I9652364667586ed1c0595fb84e822fafdb217cf9
parent 66c40119

system/common/stop_watch_legacy.cc

+8 −5
Original line number Diff line number Diff line
@@ -37,10 +37,13 @@ static std::recursive_mutex stopwatch_log_mutex; 
void StopWatchLegacy::RecordLog(StopWatchLog log) {

  std::unique_lock<std::recursive_mutex> lock(stopwatch_log_mutex, std::defer_lock);

  if (!lock.try_lock()) {

    log::info("try_lock fail. log content: {}, took {} us", log.message,

              static_cast<size_t>(std::chrono::duration_cast<std::chrono::microseconds>(

                                          stopwatch_logs[current_buffer_index].end_timestamp -

                                          stopwatch_logs[current_buffer_index].start_timestamp)

    log::info(

            "try_lock fail. log content: {}, took {} us", log.message,

            static_cast<size_t>(

                    std::chrono::duration_cast<std::chrono::microseconds>(

                            stopwatch_logs[current_buffer_index % LOG_BUFFER_LENGTH].end_timestamp -

                            stopwatch_logs[current_buffer_index % LOG_BUFFER_LENGTH]

                                    .start_timestamp)

                            .count()));

    return;

  }