ANDROID: ashmem_rust: Fix off-by-one errors in get_name()
The current logic returns an error if the name of the buffer plus the NUL terminating byte is exactly ASHMEM_NAME_LEN. This is incorrect, as names are expected to have a maximum length of ASHMEM_NAME_LEN, which accounts for the NUL terminating byte Thus, change the error condition to be true if the length of the buffer name plus the NUL terminating byte would be too big to fit in an ASHMEM_NAME_LEN sized region. Also, the buffer name is copied into indices [0 len - 1], so the NUL terminating byte should be at index len, not len + 1. Bug: 411723589 Change-Id: Ie8ecbad7b90848fea529ca7d043489edd952e333 Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
This commit is contained in:
committed by
Treehugger Robot
parent
2365f7785e
commit
56dea476ea
@@ -313,13 +313,13 @@ impl Ashmem {
|
||||
let name = asma.name.as_deref().unwrap_or(b"dev/ashmem");
|
||||
let len = name.len();
|
||||
let len_with_nul = len + 1;
|
||||
if local_name.len() <= len_with_nul {
|
||||
if local_name.len() < len_with_nul {
|
||||
// This shouldn't happen in practice since `set_name` will refuse to store a string
|
||||
// that is too long.
|
||||
return Err(EINVAL);
|
||||
}
|
||||
local_name[..len].copy_from_slice(name);
|
||||
local_name[len_with_nul] = 0;
|
||||
local_name[len] = 0;
|
||||
drop(asma);
|
||||
|
||||
writer.write_slice(&local_name[..len_with_nul])?;
|
||||
|
||||
Reference in New Issue
Block a user