ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "strdup16to8.c: fix benign integer underflow."

Browse source
This commit is contained in:
Nick Kralevich 2015-08-27 17:54:32 +00:00 • committed by Gerrit Code Review
commit d34f419826
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
libcutils/strdup16to8.c
View file

@ -55,7 +55,8 @@ extern size_t strnlen16to8(const char16_t* utf16Str, size_t len)
/* Fast path for the usual case where 3*len is < SIZE_MAX-1. /* Fast path for the usual case where 3*len is < SIZE_MAX-1.
*/ */
if (len < (SIZE_MAX-1)/3) { if (len < (SIZE_MAX-1)/3) {
while (len--) { while (len != 0) {
len--;
unsigned int uic = *utf16Str++; unsigned int uic = *utf16Str++;
if (uic > 0x07ff) if (uic > 0x07ff)
@ -69,7 +70,8 @@ extern size_t strnlen16to8(const char16_t* utf16Str, size_t len)
} }
/* The slower but paranoid version */ /* The slower but paranoid version */
while (len--) { while (len != 0) {
len--;
unsigned int uic = *utf16Str++; unsigned int uic = *utf16Str++;
size_t utf8Cur = utf8Len; size_t utf8Cur = utf8Len;
@ -112,7 +114,8 @@ extern char* strncpy16to8(char* utf8Str, const char16_t* utf16Str, size_t len)
* strnlen16to8() properly or at a minimum checked the result of * strnlen16to8() properly or at a minimum checked the result of
* its malloc(SIZE_MAX) in case of overflow. * its malloc(SIZE_MAX) in case of overflow.
*/ */
while (len--) { while (len != 0) {
len--;
unsigned int uic = *utf16Str++; unsigned int uic = *utf16Str++;
if (uic > 0x07ff) { if (uic > 0x07ff) {