commit acca427853e7e06274437d871ac67f23fcc14def
author Aart Bik <ajcbik@google.com> Thu Apr 21 15:51:41 2016 -0700
committer The Android Automerger <android-build@google.com> Thu May 26 15:17:07 2016 -0700
tree af92ab9d48f2512c212069968c49cfc8af357373
parent 0f6f6f415ba263e29ba8ee1294444ae383492a40

Fix potential buffer overrun.

BUG=27840771

Change-Id: I240f188b2e8f4b45d90138cfb3b14869cf506452

libdex/OptInvocation.cpp

diff --git a/libdex/OptInvocation.cpp b/libdex/OptInvocation.cpp
index 031ec91..a9ea3a2 100644
--- a/libdex/OptInvocation.cpp
+++ b/libdex/OptInvocation.cpp
@@ -89,9 +89,9 @@
             ALOGE("Can't get CWD while opening jar file");
             return NULL;
         }
-        strncat(absoluteFile, "/", kBufLen);
+        strncat(absoluteFile, "/", kBufLen - strlen(absoluteFile));
     }
-    strncat(absoluteFile, fileName, kBufLen);
+    strncat(absoluteFile, fileName, kBufLen - strlen(absoluteFile));
 
     /*
      * Append the name of the Jar file entry, if any.  This is not currently
@@ -99,8 +99,8 @@
      * in a Jar.
      */
     if (subFileName != NULL) {
-        strncat(absoluteFile, "/", kBufLen);
-        strncat(absoluteFile, subFileName, kBufLen);
+        strncat(absoluteFile, "/", kBufLen - strlen(absoluteFile));
+        strncat(absoluteFile, subFileName, kBufLen - strlen(absoluteFile));
     }
 
     /* Turn the path into a flat filename by replacing
@@ -138,7 +138,7 @@
 
     /* Tack on the file name for the actual cache file path.
      */
-    strncat(nameBuf, absoluteFile, kBufLen);
+    strncat(nameBuf, absoluteFile, kBufLen - strlen(nameBuf));
 
     ALOGV("Cache file for '%s' '%s' is '%s'", fileName, subFileName, nameBuf);
     return strdup(nameBuf);