diff options
| author | Adam Vartanian <flooey@google.com> | 2017-08-14 15:51:29 +0100 |
|---|---|---|
| committer | Adam Vartanian <flooey@google.com> | 2017-09-07 10:38:08 +0100 |
| commit | c17624db31b52e1a2055bfabf950cf0820bd3661 (patch) | |
| tree | f90a1f6d1fdd95f06ab144b8e0fc62011f126511 /libsparse/sparse.cpp | |
| parent | 6fdfd58fe1e67e438fc85bb28e684a8fd3aa3dcb (diff) | |
Fix integer overflow in utf{16,32}_to_utf8_length
Without an explicit check, the return value can wrap around and return
a value that is far too small to hold the data from the resulting
conversion.
No SafetyNet logging is included because when included aapt fails to
link in lmp-mr1-dev.
No CTS test is provided because it would need to allocate at least
SSIZE_MAX / 2 bytes of UTF-16 data, which is unreasonable on 64-bit
devices.
Bug: 37723026
Test: run cts -p android.security
Change-Id: Ice276dc3a5b62ad389b2e9b8caf670c76b7e5218
Merged-In: Ie2606b92b9eab1acfe8ce4663b43b81156a4cad7
Diffstat (limited to 'libsparse/sparse.cpp')
0 files changed, 0 insertions, 0 deletions