From 8f7b8a1f6c5808ea205bfb3294a313e2bcaedf7f Mon Sep 17 00:00:00 2001
From: Sergio Giro <sgiro@google.com>
Date: Thu, 21 Jul 2016 14:44:07 +0100
Subject: [PATCH 1/2] Unicode: specify destination length in utf8_to_utf16
 methods

Change-Id: I5223caa7d42f4582a982609a898a02043265c6d3
---
 core/jni/android_database_CursorWindow.cpp | 2 +-
 libs/androidfw/ResourceTypes.cpp           | 8 ++++----
 tools/aapt2/util/Util.cpp                  | 6 +++++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/core/jni/android_database_CursorWindow.cpp b/core/jni/android_database_CursorWindow.cpp
index bb09d001037da..7213414af19f4 100644
--- a/core/jni/android_database_CursorWindow.cpp
+++ b/core/jni/android_database_CursorWindow.cpp
@@ -280,7 +280,7 @@ static void fillCharArrayBufferUTF(JNIEnv* env, jobject bufferObj,
         if (size) {
             jchar* data = static_cast<jchar*>(env->GetPrimitiveArrayCritical(dataObj, NULL));
             utf8_to_utf16_no_null_terminator(reinterpret_cast<const uint8_t*>(str), len,
-                    reinterpret_cast<char16_t*>(data));
+                    reinterpret_cast<char16_t*>(data), (size_t) size);
             env->ReleasePrimitiveArrayCritical(dataObj, data, 0);
         }
         env->SetIntField(bufferObj, gCharArrayBufferClassInfo.sizeCopied, size);
diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp
index 44486774a0f2a..c91b27d047789 100644
--- a/libs/androidfw/ResourceTypes.cpp
+++ b/libs/androidfw/ResourceTypes.cpp
@@ -776,7 +776,7 @@ const char16_t* ResStringPool::stringAt(size_t idx, size_t* u16len) const
                     if (kDebugStringPoolNoisy) {
                         ALOGI("Caching UTF8 string: %s", u8str);
                     }
-                    utf8_to_utf16(u8str, u8len, u16str);
+                    utf8_to_utf16(u8str, u8len, u16str, *u16len + 1);
                     mCache[idx] = u16str;
                     return u16str;
                 } else {
@@ -877,7 +877,8 @@ ssize_t ResStringPool::indexOfString(const char16_t* str, size_t strLen) const
             // the ordering, we need to convert strings in the pool to UTF-16.
             // But we don't want to hit the cache, so instead we will have a
             // local temporary allocation for the conversions.
-            char16_t* convBuffer = (char16_t*)malloc(strLen+4);
+            size_t convBufferLen = strLen + 4;
+            char16_t* convBuffer = (char16_t*)calloc(convBufferLen, sizeof(char16_t));
             ssize_t l = 0;
             ssize_t h = mHeader->stringCount-1;
 
@@ -887,8 +888,7 @@ ssize_t ResStringPool::indexOfString(const char16_t* str, size_t strLen) const
                 const uint8_t* s = (const uint8_t*)string8At(mid, &len);
                 int c;
                 if (s != NULL) {
-                    char16_t* end = utf8_to_utf16_n(s, len, convBuffer, strLen+3);
-                    *end = 0;
+                    char16_t* end = utf8_to_utf16(s, len, convBuffer, convBufferLen);
                     c = strzcmp16(convBuffer, end-convBuffer, str, strLen);
                 } else {
                     c = -1;
diff --git a/tools/aapt2/util/Util.cpp b/tools/aapt2/util/Util.cpp
index 7b0c71d93bb5d..7ee6e774f6b4a 100644
--- a/tools/aapt2/util/Util.cpp
+++ b/tools/aapt2/util/Util.cpp
@@ -430,7 +430,11 @@ std::u16string utf8ToUtf16(const StringPiece& utf8) {
 
     std::u16string utf16;
     utf16.resize(utf16Length);
-    utf8_to_utf16(reinterpret_cast<const uint8_t*>(utf8.data()), utf8.length(), &*utf16.begin());
+    utf8_to_utf16(
+            reinterpret_cast<const uint8_t*>(utf8.data()),
+            utf8.length(),
+            &*utf16.begin(),
+            (size_t) utf16Length + 1);
     return utf16;
 }
 

From d90d8d615a99ad9f75e2911e98a166b396a89053 Mon Sep 17 00:00:00 2001
From: Sergio Giro <sgiro@google.com>
Date: Tue, 28 Jun 2016 18:26:10 +0100
Subject: [PATCH 2/2] Add bound checks to utf16_to_utf8

Test: ran libaapt2_tests64
Bug: 29250543
Change-Id: I1ebc017af623b6514cf0c493e8cd8e1d59ea26c3
(cherry picked from commit 4781057e78f63e0e99af109cebf3b6a78f4bfbb6)
---
 tools/aapt/Android.mk         | 2 +-
 tools/aapt2/util/Util.cpp     | 4 +++-
 tools/split-select/Android.mk | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/tools/aapt/Android.mk b/tools/aapt/Android.mk
index b7014454771c5..2a490d1097ef5 100644
--- a/tools/aapt/Android.mk
+++ b/tools/aapt/Android.mk
@@ -57,8 +57,8 @@ aaptTests := \
 aaptHostStaticLibs := \
     libandroidfw \
     libpng \
-    liblog \
     libutils \
+    liblog \
     libcutils \
     libexpat \
     libziparchive-host \
diff --git a/tools/aapt2/util/Util.cpp b/tools/aapt2/util/Util.cpp
index 7ee6e774f6b4a..e07c88ec9579c 100644
--- a/tools/aapt2/util/Util.cpp
+++ b/tools/aapt2/util/Util.cpp
@@ -445,8 +445,10 @@ std::string utf16ToUtf8(const StringPiece16& utf16) {
     }
 
     std::string utf8;
+    // Make room for '\0' explicitly.
+    utf8.resize(utf8Length + 1);
+    utf16_to_utf8(utf16.data(), utf16.length(), &*utf8.begin(), utf8Length + 1);
     utf8.resize(utf8Length);
-    utf16_to_utf8(utf16.data(), utf16.length(), &*utf8.begin());
     return utf8;
 }
 
diff --git a/tools/split-select/Android.mk b/tools/split-select/Android.mk
index 239bed5894120..863abae1e0fb9 100644
--- a/tools/split-select/Android.mk
+++ b/tools/split-select/Android.mk
@@ -47,8 +47,8 @@ hostStaticLibs := \
     libaapt \
     libandroidfw \
     libpng \
-    liblog \
     libutils \
+    liblog \
     libcutils \
     libexpat \
     libziparchive-host \