Skip to content

Commit 3372f2e

Browse files
Johannes CarlssonKenneth Andersson
authored andcommitted
Corrected buffer overflow when parsing /proc/wakelocks
The android_os_Process_parseProcLineArray in android_util_Process.cpp writes up to buffer[endIndex]. This sometimes caused an assert to be triggered in NewStringUTF when the output from /proc/wakelocks was larger than 4096 bytes. The buffer was also increased in order to be able to parse all wakelocks completely. Change-Id: Idf8e66d61ad979377569048f59c3eee278b146db
1 parent dd1880e commit 3372f2e

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

core/java/com/android/internal/os/BatteryStatsImpl.java

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -844,7 +844,7 @@ void readSummaryFromParcelLocked(Parcel in) {
844844

845845
private final Map<String, KernelWakelockStats> readKernelWakelockStats() {
846846

847-
byte[] buffer = new byte[4096];
847+
byte[] buffer = new byte[8192];
848848
int len;
849849

850850
try {
@@ -891,9 +891,11 @@ private final Map<String, KernelWakelockStats> parseProcWakelocks(
891891
for (endIndex=startIndex;
892892
endIndex < len && wlBuffer[endIndex] != '\n' && wlBuffer[endIndex] != '\0';
893893
endIndex++);
894-
// Don't go over the end of the buffer
895-
if (endIndex < len) {
896-
endIndex++; // endIndex is an exclusive upper bound.
894+
endIndex++; // endIndex is an exclusive upper bound.
895+
// Don't go over the end of the buffer, Process.parseProcLine might
896+
// write to wlBuffer[endIndex]
897+
if (endIndex >= (len - 1) ) {
898+
return m;
897899
}
898900

899901
String[] nameStringArray = mProcWakelocksName;

0 commit comments

Comments
 (0)