| tag | f43fadc037d4cfc84293965aff892ff0143e2fd0 | |
|---|---|---|
| tagger | The Android Open Source Project <initial-contribution@android.com> | Mon May 22 11:31:24 2017 -0700 |
| object | 7f5c6593f298ebbef9d2a669118968ea3873aa9d |
Android o preview 2
| commit | 7f5c6593f298ebbef9d2a669118968ea3873aa9d | [log] [tgz] |
|---|---|---|
| author | Jinguang Dong <dongjinguang@huawei.com> | Mon Mar 20 17:29:50 2017 +0800 |
| committer | liuchao <liuchao741@huawei.com> | Thu Mar 23 15:19:33 2017 +0800 |
| tree | 3cb3eb550738b9ec4427562eccafd6e605fcfb72 | |
| parent | 56509312054d667c83e168f01037556edba747a5 [diff] |
Fix a not properly handled pointer comparison that caused UB
The if condition in gatekeeper_messages.cpp read_from_buffer
"if(buffer_end > end || buffer_end <= *buffer)" is not
properly handled
The (buffer_end < *buffer) is gone while run, which lead to UB.
It's easy reproduce in 32-bit mode in GARBAGE_TEST(VerifyRequest).
Test: mm -j8
gatekeeper_messages_test GARBAGE_TEST(VerifyRequest)
Change-Id: I1bc2ab006788a7d387f9dd99d1bcb8edb45e04fe