1024452 - [Flame] libhwcomposer of flame has off-by-one error in HwcDebug::HwcDebug().

Status: RESOLVED DUPLICATE of bug 1034146

(Firefox OS Graveyard :: Vendcom, defect)

Description

[Thinker Li [:sinker]]

Attachment: libhwcomposer-off-by-one.diff

This is only for debug build.

Comment 1

[Thinker Li [:sinker]]

Michael, do you review and own this code?  Or, who should I talk to?

Comment 2

[Michael Wu [:mwu]]

You should talk to Diego about this.

Comment 3

[Michael Wu [:mwu]]

Or Sushil.

Comment 4

[Thinker Li [:sinker]]

Diego, had you fixed this bug?  It causes memory corruption.  In my case, it corrupts internal data of jemalloc by overflowing over several kilobytes.

Comment 5

[Sushil]

I am not getting the context of this bug. I have the user-debug build and if I log the string "mDisplayName" after strncpy(), I see the display name. I also tried with attached patch, but same output. OR does the bug point to set "Virtual" when dpy is 2?

Comment 6

[Thinker Li [:sinker]]

For mDisplayName is not initialized, it could be filled with random values.  strncpy() copies first n chars of the source string to the destination, and append a null char to the destination only if the length of the source is samller than n; i.e. strlen(src) < n.  It means to be suffixed with random data if the memory allocator does not clear out the memory since strlen(src) == n in this case.  Not all memory allocators do clearing except using calloc().

Is it enough to explain the issue here?

Comment 7

[Sushil]

Thanks. I will fix it in HAL.

Comment 8

[Sushil]

Fix had landed in HAL on CAF: https://www.codeaurora.org/cgit/quic/la/platform/hardware/qcom/display/commit/?h=b2g_kk_3.5&id=f0366091389b3f0648a92e6a7173237937bc0393