commit 821fa41fbc92dca46449d2d86e01bbc1e0976465
author Steven Moreland <smoreland@google.com> Thu May 28 00:29:08 2020 +0000
committer Anis Assi <anisassi@google.com> Thu Aug 06 17:12:47 2020 -0700
tree 6c8a3f0e21f3937801a0b369e1311fbc1ee277a1
parent 6129c4b91cb9f24b8a754f1b2d22a869ebebe5b4

String16::remove - avoid overflow

Bug: 156999009
Test: libutils_test (cases added)
Change-Id: Iad46d95d9848928ba81000090b2fe9aec1e5eaac
Merged-In: Iad46d95d9848928ba81000090b2fe9aec1e5eaac
(cherry picked from commit f251c1c581f2d1b9940e60e756315c5e15443990)
(cherry picked from commit 9a9c8910e9296c9dc8d79c37f589895f5a2a836c)
(cherry picked from commit 4048e49956a2dfd49af3adf0f78881bf15f3550f)

libutils/String16.cpp

diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index e8f1c51..7055fc6 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -402,7 +402,7 @@
         mString = getEmptyString();
         return NO_ERROR;
     }
-    if ((begin+len) > N) len = N-begin;
+    if (len > N || len > N - begin) len = N - begin;
     if (begin == 0 && len == N) {
         return NO_ERROR;
     }