Fix UBSan issue in SystemStatusNetworkInfo

Remove typeCount-- to avoid potential sub overflow
from 0 to 0xFF.

Change-Id: I1a660166f759616ce585f5c51a18df9d9a9d6bcb
CRs-fixed: 2740438

1 files changed, 9 insertions, 12 deletions

diff --git a/core/SystemStatus.h b/core/SystemStatus.h
index 8d5d9ac..edbe745 100644
--- a/core/SystemStatus.h
+++ b/core/SystemStatus.h
@@ -501,7 +501,7 @@ public:
     inline SystemStatusNetworkInfo(const NetworkInfoDataItemBase& itemBase) :
             NetworkInfoDataItemBase(itemBase),
             mSrcObjPtr((NetworkInfoDataItemBase*)&itemBase) {
-        mType = itemBase.getType();
+        mType = (int32_t)itemBase.getType();
     }
     inline bool equals(const SystemStatusNetworkInfo& peer) {
         for (uint8_t i = 0; i < MAX_NETWORK_HANDLES; ++i) {
@@ -513,9 +513,6 @@ public:
     }
     inline virtual SystemStatusItemBase& collate(SystemStatusItemBase& curInfo) {
         uint64_t allTypes = (static_cast<SystemStatusNetworkInfo&>(curInfo)).mAllTypes;
-        uint64_t networkHandle =
-                (static_cast<SystemStatusNetworkInfo&>(curInfo)).mNetworkHandle;
-        int32_t type = (static_cast<SystemStatusNetworkInfo&>(curInfo)).mType;
         // Replace current with cached table for now and then update
         memcpy(mAllNetworkHandles,
                (static_cast<SystemStatusNetworkInfo&>(curInfo)).getNetworkHandle(),
@@ -542,21 +539,21 @@ public:
                  ++lastValidIndex) {
                 // Maintain count for number of network handles still
                 // connected for given type
-                if (mType == mAllNetworkHandles[lastValidIndex].networkType) {
-                    typeCount++;
+                if (mType == (int32_t)mAllNetworkHandles[lastValidIndex].networkType) {
+                    if (mNetworkHandle == mAllNetworkHandles[lastValidIndex].networkHandle) {
+                        deletedIndex = lastValidIndex;
+                    } else {
+                        typeCount++;
+                    }
                 }
 
-                if (mNetworkHandle == mAllNetworkHandles[lastValidIndex].networkHandle) {
-                    deletedIndex = lastValidIndex;
-                    typeCount--;
-                }
             }
-            if (MAX_NETWORK_HANDLES == lastValidIndex) {
+            if (lastValidIndex > 0) {
                 --lastValidIndex;
             }
 
             if (MAX_NETWORK_HANDLES != deletedIndex) {
-                LOC_LOGD("deletedIndex:%u, lastValidIndex:%u, typeCount:%u",
+                LOC_LOGd("deletedIndex:%u, lastValidIndex:%u, typeCount:%u",
                         deletedIndex, lastValidIndex, typeCount);
                 mAllNetworkHandles[deletedIndex] = mAllNetworkHandles[lastValidIndex];
                 mAllNetworkHandles[lastValidIndex].networkHandle = NETWORK_HANDLE_UNKNOWN;