Loading libutils/VectorImpl.cpp +6 −8 Original line number Diff line number Diff line Loading @@ -279,12 +279,10 @@ ssize_t VectorImpl::replaceAt(const void* prototype, size_t index) ssize_t VectorImpl::removeItemsAt(size_t index, size_t count) { ALOG_ASSERT((index+count)<=size(), "[%p] remove: index=%d, count=%d, size=%d", this, (int)index, (int)count, (int)size()); if ((index+count) > size()) return BAD_VALUE; size_t end; LOG_ALWAYS_FATAL_IF(__builtin_add_overflow(index, count, &end), "overflow: index=%zu count=%zu", index, count); if (end > size()) return BAD_VALUE; _shrink(index, count); return index; } Loading libutils/Vector_test.cpp +9 −0 Original line number Diff line number Diff line Loading @@ -136,4 +136,13 @@ TEST_F(VectorTest, editArray_Shared) { } } TEST_F(VectorTest, removeItemsAt_overflow) { android::Vector<int> v; for (int i = 0; i < 666; i++) v.add(i); ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, 666), "overflow"); ASSERT_DEATH(v.removeItemsAt(666, SIZE_MAX), "overflow"); ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, SIZE_MAX), "overflow"); } } // namespace android Loading
libutils/VectorImpl.cpp +6 −8 Original line number Diff line number Diff line Loading @@ -279,12 +279,10 @@ ssize_t VectorImpl::replaceAt(const void* prototype, size_t index) ssize_t VectorImpl::removeItemsAt(size_t index, size_t count) { ALOG_ASSERT((index+count)<=size(), "[%p] remove: index=%d, count=%d, size=%d", this, (int)index, (int)count, (int)size()); if ((index+count) > size()) return BAD_VALUE; size_t end; LOG_ALWAYS_FATAL_IF(__builtin_add_overflow(index, count, &end), "overflow: index=%zu count=%zu", index, count); if (end > size()) return BAD_VALUE; _shrink(index, count); return index; } Loading
libutils/Vector_test.cpp +9 −0 Original line number Diff line number Diff line Loading @@ -136,4 +136,13 @@ TEST_F(VectorTest, editArray_Shared) { } } TEST_F(VectorTest, removeItemsAt_overflow) { android::Vector<int> v; for (int i = 0; i < 666; i++) v.add(i); ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, 666), "overflow"); ASSERT_DEATH(v.removeItemsAt(666, SIZE_MAX), "overflow"); ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, SIZE_MAX), "overflow"); } } // namespace android