Snap for 6787936 from 890f9f0da4cf0df9da92989d6fd378bc3b622e60 to rvc-platform-release
Change-Id: Ie4b6739c5bda6517cae76db0dbc5bc680ac8b391
diff --git a/libutils/String8.cpp b/libutils/String8.cpp
index d13548e..9d50e0b 100644
--- a/libutils/String8.cpp
+++ b/libutils/String8.cpp
@@ -322,8 +322,14 @@
n = vsnprintf(nullptr, 0, fmt, tmp_args);
va_end(tmp_args);
- if (n != 0) {
+ if (n < 0) return UNKNOWN_ERROR;
+
+ if (n > 0) {
size_t oldLength = length();
+ if ((size_t)n > SIZE_MAX - 1 ||
+ oldLength > SIZE_MAX - (size_t)n - 1) {
+ return NO_MEMORY;
+ }
char* buf = lockBuffer(oldLength + n);
if (buf) {
vsnprintf(buf + oldLength, n + 1, fmt, args);