PawletOS/android_bootable_recovery
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the double free in verify_package_compatibility().

Browse Source 
"""
void* cookie;
std::unique_ptr<void, decltype(&EndIteration)> guard(cookie, EndIteration);
  ...
EndIteration(cookie);
"""

The above pattern is buggy that frees 'cookie' twice.

Bug: 37413730
Test: Build new recovery and adb sideload a previously crashed package
      that contains 'compatibility.zip'.
Change-Id: I183c33827fb28a438ebaedda446e84cabe7cb92d
This commit is contained in:
Tao Bao
2017-04-17 10:44:00 -07:00
parent 25dbe1717e
commit f978278995
1 changed files with 0 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.cpp
-1
View File
@@ -544,7 +544,6 @@ bool verify_package_compatibility(ZipArchiveHandle package_zip) {
} }
compatibility_info.emplace_back(std::move(content)); compatibility_info.emplace_back(std::move(content));
} }
EndIteration(cookie);
CloseArchive(zip_handle); CloseArchive(zip_handle);
// TODO(b/36814503): Enable the actual verification when VintfObject::CheckCompatibility() lands. // TODO(b/36814503): Enable the actual verification when VintfObject::CheckCompatibility() lands.