Merge cherrypicks of [3898939, 3898962, 3899094, 3899255, 3897886, 3898497, 3898940, 3898963, 3898964, 3897791, 3899159, 3899160, 3899161, 3899162, 3899163, 3899164, 3898293, 3898294, 3899275, 3899276, 3899201, 3896952, 3896953, 3899165, 3898965, 3898941, 3897887, 3898942, 3898943] into sparse-4657601-L00800000163320583
Change-Id: Ide90e35daf2f3b9cfc467fe9762f32e811f082ab
diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index ad335c3..e8f1c51 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -79,6 +79,23 @@
return getEmptyString();
}
+static char16_t* allocFromUTF16(const char16_t* u16str, size_t u16len) {
+ if (u16len >= SIZE_MAX / sizeof(char16_t)) {
+ android_errorWriteLog(0x534e4554, "73826242");
+ abort();
+ }
+
+ SharedBuffer* buf = SharedBuffer::alloc((u16len + 1) * sizeof(char16_t));
+ ALOG_ASSERT(buf, "Unable to allocate shared buffer");
+ if (buf) {
+ char16_t* str = (char16_t*)buf->data();
+ memcpy(str, u16str, u16len * sizeof(char16_t));
+ str[u16len] = 0;
+ return str;
+ }
+ return getEmptyString();
+}
+
// ---------------------------------------------------------------------------
String16::String16()
@@ -111,35 +128,9 @@
setTo(o, len, begin);
}
-String16::String16(const char16_t* o)
-{
- size_t len = strlen16(o);
- SharedBuffer* buf = SharedBuffer::alloc((len+1)*sizeof(char16_t));
- ALOG_ASSERT(buf, "Unable to allocate shared buffer");
- if (buf) {
- char16_t* str = (char16_t*)buf->data();
- strcpy16(str, o);
- mString = str;
- return;
- }
+String16::String16(const char16_t* o) : mString(allocFromUTF16(o, strlen16(o))) {}
- mString = getEmptyString();
-}
-
-String16::String16(const char16_t* o, size_t len)
-{
- SharedBuffer* buf = SharedBuffer::alloc((len+1)*sizeof(char16_t));
- ALOG_ASSERT(buf, "Unable to allocate shared buffer");
- if (buf) {
- char16_t* str = (char16_t*)buf->data();
- memcpy(str, o, len*sizeof(char16_t));
- str[len] = 0;
- mString = str;
- return;
- }
-
- mString = getEmptyString();
-}
+String16::String16(const char16_t* o, size_t len) : mString(allocFromUTF16(o, len)) {}
String16::String16(const String8& o)
: mString(allocFromUTF8(o.string(), o.size()))
@@ -201,6 +192,11 @@
status_t String16::setTo(const char16_t* other, size_t len)
{
+ if (len >= SIZE_MAX / sizeof(char16_t)) {
+ android_errorWriteLog(0x534e4554, "73826242");
+ abort();
+ }
+
SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
->editResize((len+1)*sizeof(char16_t));
if (buf) {
@@ -224,6 +220,11 @@
return NO_ERROR;
}
+ if (myLen >= SIZE_MAX / sizeof(char16_t) - otherLen) {
+ android_errorWriteLog(0x534e4554, "73826242");
+ abort();
+ }
+
SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
->editResize((myLen+otherLen+1)*sizeof(char16_t));
if (buf) {
@@ -245,6 +246,11 @@
return NO_ERROR;
}
+ if (myLen >= SIZE_MAX / sizeof(char16_t) - otherLen) {
+ android_errorWriteLog(0x534e4554, "73826242");
+ abort();
+ }
+
SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
->editResize((myLen+otherLen+1)*sizeof(char16_t));
if (buf) {