Skip to content

Commit

Permalink
lshal: Fix empty hidl_array access.
Browse files Browse the repository at this point in the history
Fix this error:
  Abort message: 'Check failed: bytes != nullptr || len == 0 0x0 32'

This bug is introduced by the change below.
!hashRet.isOk() should have a break; in it like the other error cases.
The change below added this code after the error which used to be
the end of the statement.

Bug: 329190736
Fixes: b670dd7
  ("lshal: Fix mem invalid access (timeoutIPC callers)")
Test: TH
Change-Id: Iada52b2ca033105962727fcccf651fbb5bdd5736
  • Loading branch information
Yifan Hong committed Mar 18, 2024
1 parent 30ad90f commit b4cb70d
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions cmds/lshal/ListCommand.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -731,16 +731,17 @@ Status ListCommand::fetchBinderizedEntry(const sp<IServiceManager> &manager,
[hashChain](const auto& ret) { *hashChain = std::move(ret); });
if (!hashRet.isOk()) {
handleError(TRANSACTION_ERROR, "getHashChain failed: " + hashRet.description());
break; // skip getHashChain
}
if (static_cast<size_t>(hashIndex) >= hashChain->size()) {
handleError(BAD_IMPL,
"interfaceChain indicates position " + std::to_string(hashIndex) +
" but getHashChain returns " + std::to_string(hashChain->size()) +
" hashes");
} else {
auto&& hashArray = (*hashChain)[hashIndex];
entry->hash = android::base::HexString(hashArray.data(), hashArray.size());
break; // skip getHashChain
}
auto&& hashArray = (*hashChain)[hashIndex];
entry->hash = android::base::HexString(hashArray.data(), hashArray.size());
} while (0);
if (status == OK) {
entry->serviceStatus = ServiceStatus::ALIVE;
Expand Down

0 comments on commit b4cb70d

Please sign in to comment.