libutils: fix overflow in SharedBuffer (7987b835) · Commits · e / os / android_system_core

libutils/Android.mk

+13 −0

Original line number	Diff line number	Diff line
		@@ -108,6 +108,19 @@ LOCAL_CFLAGS := -Werror

		include $(BUILD_SHARED_LIBRARY)

		include $(CLEAR_VARS)
		LOCAL_MODULE := SharedBufferTest
		LOCAL_STATIC_LIBRARIES := libutils
		LOCAL_SHARED_LIBRARIES := liblog
		LOCAL_SRC_FILES := SharedBufferTest.cpp
		include $(BUILD_NATIVE_TEST)

		include $(CLEAR_VARS)
		LOCAL_MODULE := SharedBufferTest
		LOCAL_STATIC_LIBRARIES := libutils
		LOCAL_SHARED_LIBRARIES := liblog
		LOCAL_SRC_FILES := SharedBufferTest.cpp
		include $(BUILD_HOST_NATIVE_TEST)

		# Build the tests in the tests/ subdirectory.
		include $(call first-makefiles-under,$(LOCAL_PATH))

libutils/SharedBuffer.cpp

+12 −1

Original line number	Diff line number	Diff line
		@@ -17,6 +17,7 @@
		#include <stdlib.h>
		#include <string.h>

		#include <log/log.h>
		#include <utils/SharedBuffer.h>
		#include <utils/Atomic.h>

		@@ -26,6 +27,11 @@ namespace android {

		SharedBuffer* SharedBuffer::alloc(size_t size)
		{
		// Don't overflow if the combined size of the buffer / header is larger than
		// size_max.
		LOG_ALWAYS_FATAL_IF((size >= (SIZE_MAX - sizeof(SharedBuffer))),
		"Invalid buffer size %zu", size);

		SharedBuffer* sb = static_cast<SharedBuffer *>(malloc(sizeof(SharedBuffer) + size));
		if (sb) {
		sb->mRefs = 1;
		@@ -60,6 +66,11 @@ SharedBuffer* SharedBuffer::editResize(size_t newSize) const
		if (onlyOwner()) {
		SharedBuffer* buf = const_cast<SharedBuffer*>(this);
		if (buf->mSize == newSize) return buf;
		// Don't overflow if the combined size of the new buffer / header is larger than
		// size_max.
		LOG_ALWAYS_FATAL_IF((newSize >= (SIZE_MAX - sizeof(SharedBuffer))),
		"Invalid buffer size %zu", newSize);

		buf = (SharedBuffer*)realloc(buf, sizeof(SharedBuffer) + newSize);
		if (buf != NULL) {
		buf->mSize = newSize;

libutils/SharedBufferTest.cpp

0 → 100644

+56 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2015 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <utils/SharedBuffer.h>

		#include <gtest/gtest.h>

		#include <memory>
		#include <stdint.h>

		TEST(SharedBufferTest, TestAlloc) {
		EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX), "");
		EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX - sizeof(android::SharedBuffer)), "");

		// Make sure we don't die here.
		// Check that null is returned, as we are asking for the whole address space.
		android::SharedBuffer* buf =
		android::SharedBuffer::alloc(SIZE_MAX - sizeof(android::SharedBuffer) - 1);
		ASSERT_EQ(nullptr, buf);

		buf = android::SharedBuffer::alloc(0);
		ASSERT_NE(nullptr, buf);
		ASSERT_EQ(0U, buf->size());
		buf->release();
		}

		TEST(SharedBufferTest, TestEditResize) {
		android::SharedBuffer* buf = android::SharedBuffer::alloc(10);
		EXPECT_DEATH(buf->editResize(SIZE_MAX - sizeof(android::SharedBuffer)), "");
		buf = android::SharedBuffer::alloc(10);
		EXPECT_DEATH(buf->editResize(SIZE_MAX), "");

		buf = android::SharedBuffer::alloc(10);
		// Make sure we don't die here.
		// Check that null is returned, as we are asking for the whole address space.
		buf = buf->editResize(SIZE_MAX - sizeof(android::SharedBuffer) - 1);
		ASSERT_EQ(nullptr, buf);

		buf = android::SharedBuffer::alloc(10);
		buf = buf->editResize(0);
		ASSERT_EQ(0U, buf->size());
		buf->release();
		}