Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0d4b584 authored by Steven Moreland's avatar Steven Moreland Committed by Bryan Ferris
Browse files

libbinder: readCString: no ubsan sub-overflow 

Bug: 131859347
Test: fuzzer
Change-Id: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
Merged-In: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
parent cb2f0cee

libs/binder/Parcel.cpp

+2 −2
Original line number Diff line number Diff line
@@ -1907,8 +1907,8 @@ status_t Parcel::readUtf8FromUtf16(std::unique_ptr<std::string>* str) const { 


const char* Parcel::readCString() const

{

    if (mDataPos < mDataSize) {

        const size_t avail = mDataSize-mDataPos;

    if (avail > 0) {

        const char* str = reinterpret_cast<const char*>(mData+mDataPos);

        // is the string's trailing NUL within the parcel's valid bounds?

        const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));