Fix copyFrom overflow when arg is UINT32_MAX.
hidl_string's copyFrom method is actually allocating
size + 1 in order to allocate space for the extra '\0'.
This fixes the OBO in the check to avoid overflow.
Fixes: 68197287
Test: libhidl_Test
Change-Id: Ic455b9931d7068fb9d19775baba2f424a08182e3
diff --git a/base/HidlSupport.cpp b/base/HidlSupport.cpp
index f857281..aec3fed 100644
--- a/base/HidlSupport.cpp
+++ b/base/HidlSupport.cpp
@@ -217,7 +217,7 @@
void hidl_string::copyFrom(const char *data, size_t size) {
// assume my resources are freed.
- if (size > UINT32_MAX) {
+ if (size >= UINT32_MAX) {
LOG(FATAL) << "string size can't exceed 2^32 bytes: " << size;
}
char *buf = (char *)malloc(size + 1);