MiPad4/android_device_xiaomi_sdm660-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix few ASAN issues reported

Browse source 
- Fix a Use After Free issue in Gnss Update Config
If Engine Capabilities are not known yet at the time
of the MsgGnssUpdateConfig, the ids arrray will be freed
but the ids pointer will be copied into a new
MsgGnssUpdateConfig that will access the ids array again

- Issue in NetworkInfoDataItemBase which will result in
array out of bound access which might result in heap
buffer overflow.

Change-Id: Ib5a6dc29fef9eb6676d4605f92d60f26a47d1d90
CRs-fixed: 2449980
This commit is contained in:
Dante Russo 2019-05-15 15:08:30 -07:00
parent 4d6bb2da93
commit 61b7ed6bf0
2 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/data-items/DataItemConcreteTypesBase.h
View file

@ -249,7 +249,7 @@ public:
mId(NETWORKINFO_DATA_ITEM_ID) {
memset (&mAllNetworkHandles, NETWORK_HANDLE_UNKNOWN,
sizeof (mAllNetworkHandles));
mAllNetworkHandles[type] = networkHandle;
mAllNetworkHandles[initialType] = networkHandle;
}
virtual ~NetworkInfoDataItemBase() {}
inline virtual DataItemId getId() { return mId; }

21
gnss/GnssAdapter.cpp
View file

@ -997,9 +997,18 @@ GnssAdapter::gnssUpdateConfigCommand(GnssConfig config)
mConfig(config),
mCount(count),
mIds(ids) {}
inline MsgGnssUpdateConfig(const MsgGnssUpdateConfig& obj) :
MsgGnssUpdateConfig(obj.mAdapter, obj.mApi, obj.mConfig,
new uint32_t[obj.mCount], obj.mCount) {
if (mIds != nullptr) {
for (int i = 0; i < mCount; ++i) {
mIds[i] = obj.mIds[i];
}
}
}
inline virtual ~MsgGnssUpdateConfig()
{
delete [] mIds;
delete[] mIds;
}
inline virtual void proc() const {
@ -1257,6 +1266,16 @@ GnssAdapter::gnssGetConfigCommand(GnssConfigFlagsMask configMask) {
mConfigMask(configMask),
mIds(ids),
mCount(count) {}
inline MsgGnssGetConfig(const MsgGnssGetConfig& obj) :
MsgGnssGetConfig(obj.mAdapter, obj.mApi, obj.mConfigMask,
new uint32_t[obj.mCount], obj.mCount) {
if (mIds != nullptr) {
for (int i = 0; i < mCount; ++i) {
mIds[i] = obj.mIds[i];
}
}
}
inline virtual ~MsgGnssGetConfig()
{
delete[] mIds;