Skip to content

Conversation

@drkphnx
Copy link

@drkphnx drkphnx commented Jan 7, 2023

  • According to healthd_mode_charger.cpp#L106 this should be res/images/default/charger and not res/images/charger/default

Change-Id: Iabb5f5ecdd3b94c90a4b46849dd0a048da51364a

* According to healthd_mode_charger.cpp#L106 this should be
  res/images/default/charger and not res/images/charger/default

Change-Id: Iabb5f5ecdd3b94c90a4b46849dd0a048da51364a
Albinoman887 pushed a commit to Albinoman887/system_core that referenced this pull request May 20, 2023
Due to https://r.android.com/1310496, sparse_file_write() splits all
blocks larger than 64 MiB.  However, the code that splits file-backed
blocks copies the pointer to the filename without duplicating the
underlying memory, causing a double free in backed_block_destroy()
later.  Fix this by using strdup().  Also, as long as that is being
fixed, also check for failure.

Test: SANITIZE_HOST=address mmm external/e2fsprogs
      mkdir mnt
      mkfs.ext4 img 1G
      sudo mount img mnt
      sudo cp /dev/urandom mnt/file
      sudo umount mnt
      ext2simg img simg

Before this fix it gave:

    ==2216498==ERROR: AddressSanitizer: attempting double-free on 0x602000000090 in thread T0:
        #0 0x55a52454c9a2 in free out/stage2/runtimes/runtimes-x86_64-unknown-linux-gnu-bins/out/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
        Spark-Rom#1 0x7ffa247c82ee in backed_block_destroy(backed_block*) system/core/libsparse/backed_block.cpp:106:5
        Spark-Rom#2 0x7ffa247c82ee in backed_block_list_destroy(backed_block_list*) system/core/libsparse/backed_block.cpp:124:7
        Spark-Rom#3 0x7ffa247cd055 in sparse_file_destroy system/core/libsparse/sparse.cpp:49:3
        Spark-Rom#4 0x55a524587b75 in main external/e2fsprogs/contrib/android/ext2simg.c:239:2

Google: 2506666
Change-Id: I4607ef5adcf6512645342beaf91aff6033414e54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants