Skip to content

Commit 1d3fa3d

Browse files
Tej Singhanisassigoogle
authored andcommitted
[RESTRICT AUTOMERGE] Fix OOB write in noteAtomLogged
It's possible for bad atoms to have negative atom ids. This results in an OOB write when we note that the atom was logged. This adds a validation check on the logging. Also added safetynet logging for negative atoms Bug: 187957589 Test: POC in bug no longer led to the OOB write & crash Test: checked event log for safetynet logging Change-Id: I8a6b094c94309d7b02430fb860891ef814efb426 (cherry picked from commit cc0bba36c7c326e2fb75f1531547d2ed861d392c)
1 parent 6ded506 commit 1d3fa3d

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

cmds/statsd/src/guardrail/StatsdStats.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,9 +459,12 @@ void StatsdStats::notePullExceedMaxDelay(int pullAtomId) {
459459
void StatsdStats::noteAtomLogged(int atomId, int32_t timeSec) {
460460
lock_guard<std::mutex> lock(mLock);
461461

462-
if (atomId <= kMaxPushedAtomId) {
462+
if (atomId >= 0 && atomId <= kMaxPushedAtomId) {
463463
mPushedAtomStats[atomId]++;
464464
} else {
465+
if (atomId < 0) {
466+
android_errorWriteLog(0x534e4554, "187957589");
467+
}
465468
if (mNonPlatformPushedAtomStats.size() < kMaxNonPlatformPushedAtoms) {
466469
mNonPlatformPushedAtomStats[atomId]++;
467470
}

0 commit comments

Comments
 (0)