Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5d10d60 authored by Christopher Ferris's avatar Christopher Ferris Committed by Automerger Merge Worker
Browse files

Fail explicitly on length overflow. am: bff51b88 am: 14fa9c66 

Change-Id: Ida4a6a83dddfe5b79038b699d43d1ed65c63ebd3
parents 8c4d7662 14fa9c66

libutils/FileMap.cpp

+5 −1
Original line number Diff line number Diff line
@@ -189,7 +189,11 @@ bool FileMap::create(const char* origFileName, int fd, off64_t offset, size_t le 


    int adjust = offset % mPageSize;

    off64_t adjOffset = offset - adjust;

    size_t adjLength = length + adjust;

    size_t adjLength;

    if (__builtin_add_overflow(length, adjust, &adjLength)) {

        ALOGE("adjusted length overflow: length %zu adjust %d", length, adjust);

        return false;

    }



    int flags = MAP_SHARED;

    int prot = PROT_READ;

libutils/FileMap_test.cpp

+13 −0
Original line number Diff line number Diff line
@@ -52,3 +52,16 @@ TEST(FileMap, large_offset) { 
    ASSERT_EQ(0u, m.getDataLength());

    ASSERT_EQ(offset, m.getDataOffset());

}



TEST(FileMap, offset_overflow) {

    // Make sure that an end that overflows SIZE_MAX will not abort.

    // See http://b/156997193.

    TemporaryFile tf;

    ASSERT_TRUE(tf.fd != -1);



    off64_t offset = 200;

    size_t length = SIZE_MAX;



    android::FileMap m;

    ASSERT_FALSE(m.create("test", tf.fd, offset, length, true));

}