diff options
author | Ivan Lozano <ivanlozano@google.com> | 2017-12-14 19:03:56 -0800 |
---|---|---|
committer | Ivan Lozano <ivanlozano@google.com> | 2017-12-15 09:32:40 -0800 |
commit | 62fc14894b32f35641ae2b61ef7ed054c9660288 (patch) | |
tree | 56263b0e02f3e1ec705d161a478e03880d90356a /tools/aapt2/java/JavaClassGenerator.cpp | |
parent | 6e15c2a89ae9733d2552d9d0a20504a4bdf69c29 (diff) |
Fix temporary file name strlcpy size.
The strlcpy size argument overflows on integer sanitized builds.
runtime error: unsigned integer overflow: 11 - 35 cannot be represented
in type 'unsigned long'
This doesn't cause a problem because strlcpy stops on the null in
TMP_FILE_PATTERN, and localTmpFileName is defined large enough to
contain TMP_FILE_PATTERN.
This changes the size argument to the remaining length in the buffer,
and removes an extraneous '/' write as TMP_FILE_PATTERN already begins
with '/'.
Bug: 30969751
Test: Reran CTS test which triggered the overflow.
Change-Id: I20b5deeaaa1a863324dfd1d94f3135920eae48d3
Diffstat (limited to 'tools/aapt2/java/JavaClassGenerator.cpp')
0 files changed, 0 insertions, 0 deletions