commit d91285f1666a2bbca9f4d620bbd74ab87632a8c4
author Ryan Prichard <rprichard@google.com> Tue May 01 18:03:05 2018 -0700
committer Ryan Prichard <rprichard@google.com> Tue May 01 18:19:21 2018 -0700
tree 8def602a6ddf96c73f971132f87633ff1071bc73
parent 5258c2518e582585e1b00097296053b334790d13

Fix PROP_FILENAME_MAX overflow handling

Bug: b/79117743
Test: /data/nativetest64/bionic-unit-tests/bionic-unit-tests
Change-Id: Idd5aa4d195abc13c06d3e5b57aef69a68c2a9a9d

libc/system_properties/context_node.cpp

diff --git a/libc/system_properties/context_node.cpp b/libc/system_properties/context_node.cpp
index 5496b5a..d392c0a 100644
--- a/libc/system_properties/context_node.cpp
+++ b/libc/system_properties/context_node.cpp
@@ -51,7 +51,7 @@
 
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     lock_.unlock();
     return false;
   }
@@ -86,7 +86,7 @@
 bool ContextNode::CheckAccess() {
   char filename[PROP_FILENAME_MAX];
   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len > PROP_FILENAME_MAX) {
+  if (len < 0 || len >= PROP_FILENAME_MAX) {
     return false;
   }