Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Enforce null-termination in ResStringPool::stringAt"

Browse Source
This commit is contained in:
Vishwath Mohan
2015-03-12 21:17:48 +00:00
committed by Android (Google) Code Review
parent d6ee06a0c8 6521a1b743
commit 1808d437e6
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libs/androidfw/ResourceTypes.cpp
View File

@@ -701,6 +701,12 @@ const char16_t* ResStringPool::stringAt(size_t idx, size_t* u16len) const
*u16len = decodeLength(&str);
if ((uint32_t)(str+*u16len-strings) < mStringPoolSize) {
// Reject malformed (non null-terminated) strings
if (str[*u16len] != 0x0000) {
ALOGW("Bad string block: string #%d is not null-terminated",
(int)idx);
return NULL;
}
return reinterpret_cast<const char16_t*>(str);
} else {
ALOGW("Bad string block: string #%d extends to %d, past end at %d\n",
@@ -748,6 +754,13 @@ const char16_t* ResStringPool::stringAt(size_t idx, size_t* u16len) const
return NULL;
}
// Reject malformed (non null-terminated) strings
if (u8str[u8len] != 0x00) {
ALOGW("Bad string block: string #%d is not null-terminated",
(int)idx);
return NULL;
}
char16_t *u16str = (char16_t *)calloc(*u16len+1, sizeof(char16_t));
if (!u16str) {
ALOGW("No memory when trying to allocate decode cache for string #%d\n",