From 7f9b0a9fb0f5f1fff9243af7472f0a25cf7af23e Mon Sep 17 00:00:00 2001 From: Tej Singh Date: Wed, 19 May 2021 20:12:46 -0700 Subject: [PATCH] [RESTRICT AUTOMERGE] Fix OOB write in noteAtomLogged It's possible for bad atoms to have negative atom ids. This results in an OOB write when we note that the atom was logged. This adds a validation check on the logging. Also added safetynet logging for negative atoms Bug: 187957589 Test: POC in bug no longer led to the OOB write & crash Test: checked event log for safetynet logging Change-Id: I8a6b094c94309d7b02430fb860891ef814efb426 --- cmds/statsd/src/guardrail/StatsdStats.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cmds/statsd/src/guardrail/StatsdStats.cpp b/cmds/statsd/src/guardrail/StatsdStats.cpp index 764366fc420a5..087009e4b0f78 100644 --- a/cmds/statsd/src/guardrail/StatsdStats.cpp +++ b/cmds/statsd/src/guardrail/StatsdStats.cpp @@ -352,6 +352,10 @@ void StatsdStats::noteAtomLogged(int atomId, int32_t timeSec) { ALOGW("not interested in atom %d", atomId); return; } + if (atomId < 0) { + android_errorWriteLog(0x534e4554, "187957589"); + return; + } mPushedAtomStats[atomId]++; }