Closed
Bug 1024452
Opened 10 years ago
Closed 10 years ago
[Flame] libhwcomposer of flame has off-by-one error in HwcDebug::HwcDebug().
Categories
(Firefox OS Graveyard :: Vendcom, defect)
Tracking
(Not tracked)
RESOLVED
DUPLICATE
of bug 1034146
People
(Reporter: sinker, Unassigned)
Details
Attachments
(1 file)
(deleted),
patch
|
Details | Diff | Splinter Review |
This is only for debug build.
Reporter | ||
Comment 1•10 years ago
|
||
Michael, do you review and own this code? Or, who should I talk to?
Flags: needinfo?(mwu)
Reporter | ||
Comment 4•10 years ago
|
||
Diego, had you fixed this bug? It causes memory corruption. In my case, it corrupts internal data of jemalloc by overflowing over several kilobytes.
Flags: needinfo?(dwilson)
Updated•10 years ago
|
Flags: needinfo?(dwilson) → needinfo?(sushilchauhan)
I am not getting the context of this bug. I have the user-debug build and if I log the string "mDisplayName" after strncpy(), I see the display name. I also tried with attached patch, but same output. OR does the bug point to set "Virtual" when dpy is 2?
Flags: needinfo?(sushilchauhan) → needinfo?(tlee)
Reporter | ||
Comment 6•10 years ago
|
||
For mDisplayName is not initialized, it could be filled with random values. strncpy() copies first n chars of the source string to the destination, and append a null char to the destination only if the length of the source is samller than n; i.e. strlen(src) < n. It means to be suffixed with random data if the memory allocator does not clear out the memory since strlen(src) == n in this case. Not all memory allocators do clearing except using calloc(). Is it enough to explain the issue here?
Flags: needinfo?(tlee) → needinfo?(sushilchauhan)
Fix had landed in HAL on CAF: https://www.codeaurora.org/cgit/quic/la/platform/hardware/qcom/display/commit/?h=b2g_kk_3.5&id=f0366091389b3f0648a92e6a7173237937bc0393
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•