commit 864e2e22fcd0cba3f5e67680ccabd0302dfda45d
author Daniel Rosenberg <drosen@google.com> Tue Apr 12 16:30:28 2016 -0700
committer The Android Automerger <android-build@google.com> Thu Apr 21 19:11:37 2016 -0700
tree 857c2c92b9ccf1c65a563dc539d0b33987d1790a
parent ad54cfed4516292654c997910839153264ae00a0

Fix overflow in path building

An incorrect size was causing an unsigned value
to wrap, causing it to write past the end of
the buffer.

Bug: 28085658
Change-Id: Ie9625c729cca024d514ba2880ff97209d435a165

sdcard/sdcard.c

diff --git a/sdcard/sdcard.c b/sdcard/sdcard.c
index 06452aa..123fce6 100644
--- a/sdcard/sdcard.c
+++ b/sdcard/sdcard.c
@@ -337,7 +337,7 @@
 
     ssize_t pathlen = 0;
     if (node->parent && node->graft_path == NULL) {
-        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 2);
+        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 1);
         if (pathlen < 0) {
             return -1;
         }