commit 33421af60f4a5c73b34119c195c5f53d9eadca0e
author Steven Moreland <smoreland@google.com> Tue Jul 28 21:41:54 2020 +0000
committer Anis Assi <anisassi@google.com> Thu Aug 13 09:13:49 2020 -0700
tree cd78feeaa2e04a1d77de7d117d828f1723149bd5
parent 760011d66d27df2e0452307cef4a9799b1c8f4a2

libutils: check vsnprintf error

For encoding errors, this function will return a negative value which
causes problems down the line. Check for an error and return. Also,
integer overflows are guarded.

Bug: 161894517
Test: fuzzer test case
Change-Id: Ia85067d4258bde4b875c832d6223db5dd26b8838
Merged-In: Ia85067d4258bde4b875c832d6223db5dd26b8838
(cherry picked from commit ee22384c54d42149491c8b9dbcda0d8c5e88eddc)

libutils/String8.cpp

diff --git a/libutils/String8.cpp b/libutils/String8.cpp
index ad0e72e..8f9c9f7 100644
--- a/libutils/String8.cpp
+++ b/libutils/String8.cpp
@@ -346,8 +346,14 @@
     n = vsnprintf(NULL, 0, fmt, tmp_args);
     va_end(tmp_args);
 
-    if (n != 0) {
+    if (n < 0) return UNKNOWN_ERROR;
+
+    if (n > 0) {
         size_t oldLength = length();
+        if ((size_t)n > SIZE_MAX - 1 ||
+            oldLength > SIZE_MAX - (size_t)n - 1) {
+            return NO_MEMORY;
+        }
         char* buf = lockBuffer(oldLength + n);
         if (buf) {
             vsnprintf(buf + oldLength, n + 1, fmt, args);