DO NOT MERGE - Merge RP1A.201005.006

Bug: 168212094
Change-Id: I79a7517bce1c012eac2a2a7c1c2cffc5a3516eaa
Merged-In: Ia85067d4258bde4b875c832d6223db5dd26b8838
This commit is contained in:
The Android Open Source Project 2020-10-05 21:00:29 -07:00 committed by Xin Li
commit 7fd5f8d2bc

View file

@ -309,8 +309,14 @@ status_t String8::appendFormatV(const char* fmt, va_list args)
n = vsnprintf(nullptr, 0, fmt, tmp_args);
va_end(tmp_args);
if (n != 0) {
if (n < 0) return UNKNOWN_ERROR;
if (n > 0) {
size_t oldLength = length();
if ((size_t)n > SIZE_MAX - 1 ||
oldLength > SIZE_MAX - (size_t)n - 1) {
return NO_MEMORY;
}
char* buf = lockBuffer(oldLength + n);
if (buf) {
vsnprintf(buf + oldLength, n + 1, fmt, args);