diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2017-09-21 23:33:50 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2017-09-21 23:33:50 +0000 |
commit | 01e59db4e5179e4087cad8fed44a0f1252fb9a8c (patch) | |
tree | 1a3105eed4693118de4f0745a4d43bda461ef826 | |
parent | 6cd85e2a89347e0a107f59e38ece61fa19e6da78 (diff) | |
parent | 642f66b9c95f369fef556c1668582794ec4dbbf6 (diff) | |
download | core-android-8.0.0_r25.tar.gz |
Merge cherrypicks of [2937968, 2940489, 2939606, 2939607, 2940434, 2940435, 2940436, 2940437, 2940509, 2940510, 2940118, 2940119, 2940120, 2940121, 2940122, 2938726, 2938728, 2940550, 2940552, 2940554, 2940556, 2940511, 2940512, 2940513, 2940514, 2940515, 2940558, 2940649, 2940650, 2940441, 2940442, 2940559, 2940560, 2940561, 2940562, 2940563, 2940564, 2938336, 2940565, 2940566, 2940516, 2940443, 2940517, 2940444, 2940445] into oc-dr1-releaseandroid-8.0.0_r33android-8.0.0_r25oreo-dr1-release
Change-Id: I63e94e2e1bdd2a2748fdc1df70db3e439e806862
-rw-r--r-- | libutils/Unicode.cpp | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/libutils/Unicode.cpp b/libutils/Unicode.cpp index 5fd915524..6cff0f476 100644 --- a/libutils/Unicode.cpp +++ b/libutils/Unicode.cpp @@ -180,7 +180,15 @@ ssize_t utf32_to_utf8_length(const char32_t *src, size_t src_len) size_t ret = 0; const char32_t *end = src + src_len; while (src < end) { - ret += utf32_codepoint_utf8_length(*src++); + size_t char_len = utf32_codepoint_utf8_length(*src++); + if (SSIZE_MAX - char_len < ret) { + // If this happens, we would overflow the ssize_t type when + // returning from this function, so we cannot express how + // long this string is in an ssize_t. + android_errorWriteLog(0x534e4554, "37723026"); + return -1; + } + ret += char_len; } return ret; } @@ -440,14 +448,23 @@ ssize_t utf16_to_utf8_length(const char16_t *src, size_t src_len) size_t ret = 0; const char16_t* const end = src + src_len; while (src < end) { + size_t char_len; if ((*src & 0xFC00) == 0xD800 && (src + 1) < end && (*(src + 1) & 0xFC00) == 0xDC00) { // surrogate pairs are always 4 bytes. - ret += 4; + char_len = 4; src += 2; } else { - ret += utf32_codepoint_utf8_length((char32_t) *src++); + char_len = utf32_codepoint_utf8_length((char32_t)*src++); + } + if (SSIZE_MAX - char_len < ret) { + // If this happens, we would overflow the ssize_t type when + // returning from this function, so we cannot express how + // long this string is in an ssize_t. + android_errorWriteLog(0x534e4554, "37723026"); + return -1; } + ret += char_len; } return ret; } |