Fix use-after-free issue caught by ASAN.
Keep strong references to std::string objects around while we're
actively using them in fts_open().
Test: builds, boots
Bug: 36975037
Change-Id: Icd7cba5852a01f0a1015e7d0d7dcd3087fa44ae8
diff --git a/cmds/installd/InstalldNativeService.cpp b/cmds/installd/InstalldNativeService.cpp
index 3e0f6f0..4d8d9d1 100644
--- a/cmds/installd/InstalldNativeService.cpp
+++ b/cmds/installd/InstalldNativeService.cpp
@@ -617,11 +617,9 @@
ATRACE_BEGIN("fixup user");
FTS* fts;
FTSENT* p;
- char *argv[] = {
- (char*) create_data_user_ce_path(uuid_, user).c_str(),
- (char*) create_data_user_de_path(uuid_, user).c_str(),
- nullptr
- };
+ auto ce_path = create_data_user_ce_path(uuid_, user);
+ auto de_path = create_data_user_de_path(uuid_, user);
+ char *argv[] = { (char*) ce_path.c_str(), (char*) de_path.c_str(), nullptr };
if (!(fts = fts_open(argv, FTS_PHYSICAL | FTS_NOCHDIR | FTS_XDEV, NULL))) {
return error("Failed to fts_open");
}
@@ -950,11 +948,9 @@
for (auto user : get_known_users(uuid_)) {
FTS *fts;
FTSENT *p;
- char *argv[] = {
- (char*) create_data_user_ce_path(uuid_, user).c_str(),
- (char*) create_data_user_de_path(uuid_, user).c_str(),
- nullptr
- };
+ auto ce_path = create_data_user_ce_path(uuid_, user);
+ auto de_path = create_data_user_de_path(uuid_, user);
+ char *argv[] = { (char*) ce_path.c_str(), (char*) de_path.c_str(), nullptr };
if (!(fts = fts_open(argv, FTS_PHYSICAL | FTS_NOCHDIR | FTS_XDEV, NULL))) {
return error("Failed to fts_open");
}