Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix stack-use-after-scope for a std::string

Browse Source 
`android::util::Utf16ToUtf8()` actually returns a `std::string` due to
the actual conversion to Utf8. `ParseResourceNamedType()` operates on a
`StringPiece` of `converted` (the `std::string` returned from that
call), and stashes it away for later use. Of course, by the time we're
using the `StringPiece` in `parsed_type`, `converted` has already gone
out of scope and is invalid to access.

Bug: http://b/250827883
Test: ./art/test/testrunner/run_build_test_target.py -j80 art-asan

Change-Id: Iea71a5cc84b7dfa96e7dcb549435f8394770a4df
This commit is contained in:
Stephen Hines
2022-10-04 02:36:07 -07:00
parent 81a53c761a
commit eb39a51194
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tools/aapt2/ResourceUtils.cpp
View File

@@ -43,8 +43,9 @@ namespace ResourceUtils {
static std::optional<ResourceNamedType> ToResourceNamedType(const char16_t* type16, static std::optional<ResourceNamedType> ToResourceNamedType(const char16_t* type16,
const char* type, size_t type_len) { const char* type, size_t type_len) {
std::optional<ResourceNamedTypeRef> parsed_type; std::optional<ResourceNamedTypeRef> parsed_type;
std::string converted;
if (type16) { if (type16) {
auto converted = android::util::Utf16ToUtf8(StringPiece16(type16, type_len)); converted = android::util::Utf16ToUtf8(StringPiece16(type16, type_len));
parsed_type = ParseResourceNamedType(converted); parsed_type = ParseResourceNamedType(converted);
} else if (type) { } else if (type) {
parsed_type = ParseResourceNamedType(StringPiece(type, type_len)); parsed_type = ParseResourceNamedType(StringPiece(type, type_len));