From eb39a511944e20112208ba6feb1d92f15c467999 Mon Sep 17 00:00:00 2001 From: Stephen Hines Date: Tue, 4 Oct 2022 02:36:07 -0700 Subject: [PATCH] Fix stack-use-after-scope for a `std::string` `android::util::Utf16ToUtf8()` actually returns a `std::string` due to the actual conversion to Utf8. `ParseResourceNamedType()` operates on a `StringPiece` of `converted` (the `std::string` returned from that call), and stashes it away for later use. Of course, by the time we're using the `StringPiece` in `parsed_type`, `converted` has already gone out of scope and is invalid to access. Bug: http://b/250827883 Test: ./art/test/testrunner/run_build_test_target.py -j80 art-asan Change-Id: Iea71a5cc84b7dfa96e7dcb549435f8394770a4df --- tools/aapt2/ResourceUtils.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/aapt2/ResourceUtils.cpp b/tools/aapt2/ResourceUtils.cpp index 945f45b8a3376..41c7435b534d5 100644 --- a/tools/aapt2/ResourceUtils.cpp +++ b/tools/aapt2/ResourceUtils.cpp @@ -43,8 +43,9 @@ namespace ResourceUtils { static std::optional ToResourceNamedType(const char16_t* type16, const char* type, size_t type_len) { std::optional parsed_type; + std::string converted; if (type16) { - auto converted = android::util::Utf16ToUtf8(StringPiece16(type16, type_len)); + converted = android::util::Utf16ToUtf8(StringPiece16(type16, type_len)); parsed_type = ParseResourceNamedType(converted); } else if (type) { parsed_type = ParseResourceNamedType(StringPiece(type, type_len));