ef4507b6c8
Due to https://r.android.com/1310496, sparse_file_write() splits all blocks larger than 64 MiB. However, the code that splits file-backed blocks copies the pointer to the filename without duplicating the underlying memory, causing a double free in backed_block_destroy() later. Fix this by using strdup(). Also, as long as that is being fixed, also check for failure. Test: SANITIZE_HOST=address mmm external/e2fsprogs mkdir mnt mkfs.ext4 img 1G sudo mount img mnt sudo cp /dev/urandom mnt/file sudo umount mnt ext2simg img simg Before this fix it gave: ==2216498==ERROR: AddressSanitizer: attempting double-free on 0x602000000090 in thread T0: #0 0x55a52454c9a2 in free out/stage2/runtimes/runtimes-x86_64-unknown-linux-gnu-bins/out/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 #1 0x7ffa247c82ee in backed_block_destroy(backed_block*) system/core/libsparse/backed_block.cpp:106:5 #2 0x7ffa247c82ee in backed_block_list_destroy(backed_block_list*) system/core/libsparse/backed_block.cpp:124:7 #3 0x7ffa247cd055 in sparse_file_destroy system/core/libsparse/sparse.cpp:49:3 #4 0x55a524587b75 in main external/e2fsprogs/contrib/android/ext2simg.c:239:2 Change-Id: I4607ef5adcf6512645342beaf91aff6033414e54 |
||
|---|---|---|
| .. | ||
| include/sparse | ||
| .clang-format | ||
| Android.bp | ||
| append2simg.cpp | ||
| backed_block.cpp | ||
| backed_block.h | ||
| defs.h | ||
| img2simg.cpp | ||
| output_file.cpp | ||
| output_file.h | ||
| OWNERS | ||
| simg2img.cpp | ||
| simg_dump.py | ||
| sparse.cpp | ||
| sparse_crc32.cpp | ||
| sparse_crc32.h | ||
| sparse_defs.h | ||
| sparse_err.cpp | ||
| sparse_file.h | ||
| sparse_format.h | ||
| sparse_fuzzer.cpp | ||
| sparse_read.cpp | ||