MiPad4/android_device_xiaomi_sdm660-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

memory management fixes

Browse source 
byte long each, but the loc_set_config_entry() util call
writes an int at a time, causing buffer overflow. #2, in
loc_xtra-init(), a data structure wrap happened without
iniializing the unused data fields.

Change-Id: I96b40a330316927d276840a997082fe759263699
CRs-Fixed: 866937
This commit is contained in:
Kevin Tang 2015-07-06 14:14:17 -07:00 committed by Gerrit - the friendly Code Review server
parent 95fbf27ce1
commit a38a8b8477
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
loc_api/libloc_api_50001/loc.cpp
View file

@ -805,7 +805,10 @@ SIDE EFFECTS
static int loc_xtra_init(GpsXtraCallbacks* callbacks) static int loc_xtra_init(GpsXtraCallbacks* callbacks)
{ {
ENTRY_LOG(); ENTRY_LOG();
int ret_val = loc_eng_xtra_init(loc_afw_data, (GpsXtraExtCallbacks*)callbacks); GpsXtraExtCallbacks extCallbacks;
memset(&extCallbacks, 0, sizeof(extCallbacks));
extCallbacks.download_request_cb = callbacks->download_request_cb;
int ret_val = loc_eng_xtra_init(loc_afw_data, &extCallbacks);
EXIT_LOG(%d, ret_val); EXIT_LOG(%d, ret_val);
return ret_val; return ret_val;

4
utils/loc_cfg.cpp
View file

@ -52,8 +52,8 @@
*============================================================================*/ *============================================================================*/
/* Parameter data */ /* Parameter data */
static uint8_t DEBUG_LEVEL = 0xff; static uint32_t DEBUG_LEVEL = 0xff;
static uint8_t TIMESTAMP = 0; static uint32_t TIMESTAMP = 0;
/* Parameter spec table */ /* Parameter spec table */
static loc_param_s_type loc_param_table[] = static loc_param_s_type loc_param_table[] =