Fix PROP_FILENAME_MAX overflow handling

Bug: b/79117743
Test: /data/nativetest64/bionic-unit-tests/bionic-unit-tests
Change-Id: Idd5aa4d195abc13c06d3e5b57aef69a68c2a9a9d

4 files changed, 6 insertions, 6 deletions

diff --git a/libc/system_properties/context_node.cpp b/libc/system_properties/context_node.cpp
index 5496b5a9a..d392c0ad5 100644
--- a/libc/system_properties/context_node.cpp
+++ b/libc/system_properties/context_node.cpp
@@ -51,7 +51,7 @@ bool ContextNode::Open(bool access_rw, bool* fsetxattr_failed) {
 
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     lock_.unlock();
     return false;
   }
@@ -86,7 +86,7 @@ void ContextNode::ResetAccess() {
 bool ContextNode::CheckAccess() {
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     return false;
   }
 
diff --git a/libc/system_properties/contexts_serialized.cpp b/libc/system_properties/contexts_serialized.cpp
index 062e8a5cc..12e971563 100644
--- a/libc/system_properties/contexts_serialized.cpp
+++ b/libc/system_properties/contexts_serialized.cpp
@@ -68,7 +68,7 @@ bool ContextsSerialized::InitializeContextNodes() {
 bool ContextsSerialized::MapSerialPropertyArea(bool access_rw, bool* fsetxattr_failed) {
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/properties_serial", filename_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     serial_prop_area_ = nullptr;
     return false;
   }
diff --git a/libc/system_properties/contexts_split.cpp b/libc/system_properties/contexts_split.cpp
index 92baedd38..11db7ec68 100644
--- a/libc/system_properties/contexts_split.cpp
+++ b/libc/system_properties/contexts_split.cpp
@@ -196,7 +196,7 @@ static int read_spec_entries(char* line_buf, int num_args, ...) {
 bool ContextsSplit::MapSerialPropertyArea(bool access_rw, bool* fsetxattr_failed) {
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/properties_serial", filename_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     serial_prop_area_ = nullptr;
     return false;
   }
diff --git a/libc/system_properties/system_properties.cpp b/libc/system_properties/system_properties.cpp
index 7c48b8e49..d5c36471d 100644
--- a/libc/system_properties/system_properties.cpp
+++ b/libc/system_properties/system_properties.cpp
@@ -67,7 +67,7 @@ bool SystemProperties::Init(const char* filename) {
     return true;
   }
 
-  if (strlen(filename) > PROP_FILENAME_MAX) {
+  if (strlen(filename) >= PROP_FILENAME_MAX) {
     return false;
   }
   strcpy(property_filename_, filename);
@@ -95,7 +95,7 @@ bool SystemProperties::Init(const char* filename) {
 }
 
 bool SystemProperties::AreaInit(const char* filename, bool* fsetxattr_failed) {
-  if (strlen(filename) > PROP_FILENAME_MAX) {
+  if (strlen(filename) >= PROP_FILENAME_MAX) {
     return false;
   }
   strcpy(property_filename_, filename);