diff --git a/libutils/VectorImpl.cpp b/libutils/VectorImpl.cpp index c97a19bc6..d951b8bbb 100644 --- a/libutils/VectorImpl.cpp +++ b/libutils/VectorImpl.cpp @@ -279,14 +279,12 @@ ssize_t VectorImpl::replaceAt(const void* prototype, size_t index) ssize_t VectorImpl::removeItemsAt(size_t index, size_t count) { - ALOG_ASSERT((index+count)<=size(), - "[%p] remove: index=%d, count=%d, size=%d", - this, (int)index, (int)count, (int)size()); - - if ((index+count) > size()) - return BAD_VALUE; - _shrink(index, count); - return index; + size_t end; + LOG_ALWAYS_FATAL_IF(__builtin_add_overflow(index, count, &end), "overflow: index=%zu count=%zu", + index, count); + if (end > size()) return BAD_VALUE; + _shrink(index, count); + return index; } void VectorImpl::finish_vector() diff --git a/libutils/Vector_test.cpp b/libutils/Vector_test.cpp index 5336c40c3..6d90eaa9e 100644 --- a/libutils/Vector_test.cpp +++ b/libutils/Vector_test.cpp @@ -136,4 +136,13 @@ TEST_F(VectorTest, editArray_Shared) { } } +TEST_F(VectorTest, removeItemsAt_overflow) { + android::Vector v; + for (int i = 0; i < 666; i++) v.add(i); + + ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, 666), "overflow"); + ASSERT_DEATH(v.removeItemsAt(666, SIZE_MAX), "overflow"); + ASSERT_DEATH(v.removeItemsAt(SIZE_MAX, SIZE_MAX), "overflow"); +} + } // namespace android