PawletOS/android_bootable_recovery
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the double free in verify_package_compatibility().

Browse Source 
"""
void* cookie;
std::unique_ptr<void, decltype(&EndIteration)> guard(cookie, EndIteration);
  ...
EndIteration(cookie);
"""

The above pattern is buggy that frees 'cookie' twice.

Bug: 37413730
Test: Build new recovery and adb sideload a previously crashed package
      that contains 'compatibility.zip'.
Change-Id: I183c33827fb28a438ebaedda446e84cabe7cb92d
(cherry picked from commit f978278995)
This commit is contained in:
Tao Bao
2017-04-17 10:44:00 -07:00
parent 7fdcb19e10
commit 99c549db74
1 changed files with 0 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
install.cpp
View File

@@ -544,7 +544,6 @@ bool verify_package_compatibility(ZipArchiveHandle package_zip) {
}
compatibility_info.emplace_back(std::move(content));
}
EndIteration(cookie);
CloseArchive(zip_handle);
// TODO(b/36814503): Enable the actual verification when VintfObject::CheckCompatibility() lands.