Eric Rahm [:erahm] Reporter
	Description • 10 years ago

On my Flame, |HwcDebug::HwcDebug| performs a |strncpy| with an incorrect length which leads to a non-null terminated string. It then does a |sprintf| with this value leading to memory corruption.

DMD builds are crashing 100% of the time due to this, but it is certainly happening other builds as well. This affects 1.4+ at least.

	Eric Rahm [:erahm] Reporter
	Comment 1 • 10 years ago

Sushil can you take a look at this?

	Kyle Huey (Exited; not receiving bugmail, old account, do not use)
	Comment 2 • 10 years ago

Nominating for 1.4.  People are still testing/developing 1.4 on QC devices (e.g. Flame) so we need this there to have working tools.

	Sushil Assignee
	Comment 3 • 10 years ago

Fix for this issue has landed in HAL. Can you please test with the CAF patch:

https://www.codeaurora.org/cgit/quic/la/platform/hardware/qcom/display/commit/?h=b2g_kk_3.5&id=f0366091389b3f0648a92e6a7173237937bc0393

	Sushil Assignee
	Comment 4 • 10 years ago

Eric, can you test with above CAF patch and let me know?

	Eric Rahm [:erahm] Reporter
	Comment 6 • 10 years ago

(In reply to Sushil from comment #4)
> Eric, can you test with above CAF patch and let me know?

The patch does not apply to my local checkout, inspecting by hand does indicate that it contains approximately the same fix.

	Sushil Assignee
	Comment 7 • 10 years ago

Thanks.

	Wayne Chang [:wchang]
	Comment 8 • 10 years ago

Hi Vincent,

Can you check if this patch has any impact on non-caf projects?

Thanks

	Nicholas Nethercote [inactive]
	Comment 9 • 10 years ago

erahm gets a gold star for this one.

	Vincent Liu[:vliu]
	Comment 10 • 10 years ago

(In reply to Wayne Chang [:wchang] from comment #8)
> Hi Vincent,
> 
> Can you check if this patch has any impact on non-caf projects?
> 
> Thanks

Checked with two other non-caf jrojects and they didn't have HwcDebug::HwcDebug() code implementation.

	Wayne Chang [:wchang]
	Comment 11 • 10 years ago

Taking per comments to improve testing

	Naoki Hirata :nhirata (please use needinfo instead of cc)
	Comment 12 • 10 years ago

Hi Eric, I was wondering is this fixed for 1.4+?  Or do we need to push it to 2.0, 2.1?

	Eric Rahm [:erahm] Reporter
	Comment 13 • 10 years ago

We're still waiting for the fix to land upstream. See bug 1019634 comment 18.

	Michael Wu [:mwu]
	Comment 14 • 10 years ago

2.0: https://github.com/mozilla-b2g/b2g-manifest/commit/d2babab58743c696f46d614e84fdb9f2a0dd75d7

	Michael Wu [:mwu]
	Comment 15 • 10 years ago

1.4: https://github.com/mozilla-b2g/b2g-manifest/commit/ad87526f60b8411262813189d5d023c0c43a17eb