Commit d09003d1 authored Aug 20, 2019 by Peter Collingbourne

gpuservice: Use startsWith() instead of compare() to check for a string prefix.

This fixes the behaviour in the case where the argument is lexicographically
greater than but not a prefix of "--gpumem=", as well as an out-of-bounds
read in the case where the argument is shorter than nine characters.
Found by running the CTS under HWASAN.

Bug: 139744799
Change-Id: Ie05bb31d9f490e45945ea26e1b03b9b5df4b976d

parent 82c7531e

services/gpuservice/GpuService.cpp

+1 −1

Original line number	Diff line number	Diff line
		@@ -261,7 +261,7 @@ status_t GpuService::doDump(int fd, const Vector<String16>& args, bool /*asProto
		dumpDriverInfo = true;
		} else if (args[index] == String16("--gpumem")) {
		dumpMemory = true;
		} else if (args[index].compare(String16("--gpumem=")) > 0) {
		} else if (args[index].startsWith(String16("--gpumem="))) {
		dumpMemory = true;
		pid = atoi(String8(&args[index][9]));
		}