commit 6658f2faec45be866495f3f360c7ed761e864ad9
author Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jun 05 01:50:20 2019 +0000
committer Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jun 05 01:50:20 2019 +0000
tree d36e5681a52d31b36234fe0d33545710995e2b18
parent c4a5f5ec811b149428e0835b7aabc6c4c802e720
parent 85c1e41520b430bc0cfd6ee8dc0ee289144beb95

[automerger] libbinder: readCString: no ubsan sub-overflow am: d0d4b584fc am: a7134ad559 am: 7e71b6ee21 am: 2537a8b5b6 am: 85c1e41520

Change-Id: I63f464f1086ae9a473c15ab13d96f91d531609b0

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 9d96dd6..ca8277d 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -2013,8 +2013,8 @@
 
 const char* Parcel::readCString() const
 {
-    const size_t avail = mDataSize-mDataPos;
-    if (avail > 0) {
+    if (mDataPos < mDataSize) {
+        const size_t avail = mDataSize-mDataPos;
         const char* str = reinterpret_cast<const char*>(mData+mDataPos);
         // is the string's trailing NUL within the parcel's valid bounds?
         const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));