From b2bbdaa42f5be34970aae63b37bd0a4272a035db Mon Sep 17 00:00:00 2001 From: Jeff Sharkey Date: Tue, 20 Oct 2020 13:19:04 -0600 Subject: Fixed CursorWindow signed math for x86 builds. All tests for our recent CursorWindow changes have been passing for ARM 64-bit builds, but they weren't executed against 32-bit x86 builds until after merged. It's not actually safe to use the "off_t" type, so we need to cast to "int32_t" when doing checks against possible-negative values, such as in allocRow(). We also add tests that verify negative rows/columns are identified as invalid positions, which requires that we check the resulting pointer against both mSlotsEnd and mSlotsStart. Bug: 169251528, 171276404, 171275409 Test: atest libandroidfw_tests:CursorWindowTest Test: atest CtsDatabaseTestCases Change-Id: Iea5f7546850f691e183fbb6e6d0952cd02b00d0f --- libs/androidfw/CursorWindow.cpp | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'libs/androidfw/CursorWindow.cpp') diff --git a/libs/androidfw/CursorWindow.cpp b/libs/androidfw/CursorWindow.cpp index 915c0d75a280..1b8db46c54b6 100644 --- a/libs/androidfw/CursorWindow.cpp +++ b/libs/androidfw/CursorWindow.cpp @@ -291,11 +291,11 @@ status_t CursorWindow::allocRow() { return INVALID_OPERATION; } size_t size = mNumColumns * kSlotSizeBytes; - off_t newOffset = mSlotsOffset - size; - if (newOffset < mAllocOffset) { + int32_t newOffset = mSlotsOffset - size; + if (newOffset < (int32_t) mAllocOffset) { maybeInflate(); newOffset = mSlotsOffset - size; - if (newOffset < mAllocOffset) { + if (newOffset < (int32_t) mAllocOffset) { return NO_MEMORY; } } @@ -311,7 +311,7 @@ status_t CursorWindow::freeLastRow() { return INVALID_OPERATION; } size_t size = mNumColumns * kSlotSizeBytes; - off_t newOffset = mSlotsOffset + size; + size_t newOffset = mSlotsOffset + size; if (newOffset > mSize) { return NO_MEMORY; } @@ -326,7 +326,7 @@ status_t CursorWindow::alloc(size_t size, uint32_t* outOffset) { return INVALID_OPERATION; } size_t alignedSize = (size + 3) & ~3; - off_t newOffset = mAllocOffset + alignedSize; + size_t newOffset = mAllocOffset + alignedSize; if (newOffset > mSlotsOffset) { maybeInflate(); newOffset = mAllocOffset + alignedSize; @@ -345,7 +345,7 @@ CursorWindow::FieldSlot* CursorWindow::getFieldSlot(uint32_t row, uint32_t colum // see CursorWindow_bench.cpp for more details void *result = static_cast(mSlotsStart) - (((row * mNumColumns) + column) << kSlotShift); - if (result < mSlotsEnd || column >= mNumColumns) { + if (result < mSlotsEnd || result > mSlotsStart || column >= mNumColumns) { LOG(ERROR) << "Failed to read row " << row << ", column " << column << " from a window with " << mNumRows << " rows, " << mNumColumns << " columns"; return nullptr; -- cgit v1.2.3