diff options
author | Ivan Lozano <ivanlozano@google.com> | 2017-12-14 19:03:56 -0800 |
---|---|---|
committer | Ivan Lozano <ivanlozano@google.com> | 2017-12-21 08:15:35 -0800 |
commit | 7f71764ce62fbb71f0ffc89ce9271115935fe240 (patch) | |
tree | 97b4d46636fcba16af175de99e34d2a3375a4315 /rs/java/android/renderscript/RenderScriptCacheDir.java | |
parent | 71b25c06a75ef54818dc9986f530f02580ac51e4 (diff) |
Fix temporary file name strlcpy size.
The strlcpy size argument overflows on integer sanitized builds.
runtime error: unsigned integer overflow: 11 - 35 cannot be represented
in type 'unsigned long'
This doesn't cause a problem because strlcpy stops on the null in
TMP_FILE_PATTERN, and localTmpFileName is defined large enough to
contain TMP_FILE_PATTERN.
This changes the size argument to the remaining length in the buffer,
and removes an extraneous '/' write as TMP_FILE_PATTERN already begins
with '/'.
Bug: 30969751
Test: Reran CTS test which triggered the overflow.
Change-Id: I20b5deeaaa1a863324dfd1d94f3135920eae48d3
Merged-In: I20b5deeaaa1a863324dfd1d94f3135920eae48d2
(cherry picked from commit 62fc14894b32f35641ae2b61ef7ed054c9660288)
Diffstat (limited to 'rs/java/android/renderscript/RenderScriptCacheDir.java')
0 files changed, 0 insertions, 0 deletions