S3AOSP/android_hardware_samsung — pull request #1 by basyskom-meerkoetter (2013-11-27 08:05:18+00:00)
Title: Do not overflow the malloc'd buffers

I've seen macloader crash with the following backtrace:

F/libc ( 182): *** vsprintf buffer overflow detected ***
F/libc ( 182): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=128), thread
182 (macloader)
I/DEBUG ( 181): *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
***
I/DEBUG ( 181): Build fingerprint:
'samsung/m0xx/m0:4.2.2/JDQ39E/I9300XXDLIB:user/release-keys'
I/DEBUG ( 181): Revision: '12'
I/DEBUG ( 181): pid: 182, tid: 182, name: macloader >>>
/system/bin/macloader <<<
I/DEBUG ( 181): signal 11 (SIGSEGV), code 128 (?), fault addr 00000000
I/DEBUG ( 181): r0 00000027 r1 deadbaad r2 40195258 r3 00000000
I/DEBUG ( 181): r4 00000000 r5 bf7f7a9c r6 400b1b10 r7 400b1b25
I/DEBUG ( 181): r8 00000000 r9 400b2fb8 sl 00000000 fp 41fd4140
I/DEBUG ( 181): ip 00000000 sp bf7f7a98 lr 4016833d pc 401649fa
cpsr 600b0030
I/DEBUG ( 181): d0 66746e6972707364 d1 2072656666756220
I/DEBUG ( 181): d2 776f6c667265762a d3 657463657465642a
I/DEBUG ( 181): d4 0000000000000000 d5 0000000000000000
I/DEBUG ( 181): d6 0000000000000000 d7 008529d800000000
I/DEBUG ( 181): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 181): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 181): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 181): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 181): d16 4160a53b18f5c28f d17 3f50624dd2f1a9fc
I/DEBUG ( 181): d18 41c5aa9366000000 d19 0000000000000000
I/DEBUG ( 181): d20 0000000000000000 d21 0000000000000000
I/DEBUG ( 181): d22 0000000000000000 d23 0000000000000000
I/DEBUG ( 181): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 181): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 181): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 181): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 181): scr 00000010
I/DEBUG ( 181):
I/DEBUG ( 181): backtrace:
I/DEBUG ( 181): #00 pc 0001a9fa /system/lib/libc.so
I/DEBUG ( 181): #01 pc 00018074 /system/lib/libc.so (abort+4)
I/DEBUG ( 181): #02 pc 000217d9 /system/lib/libc.so
(__vsprintf_chk+32)
I/DEBUG ( 181): #03 pc 0002177d /system/lib/libc.so
(__sprintf_chk+16)
I/DEBUG ( 181): #04 pc 00000921 /system/bin/macloader
I/DEBUG ( 181): #05 pc 0001272b /system/lib/libc.so (__libc_init+38)
I/DEBUG ( 181): #06 pc 0000062c /system/bin/macloader

The reason is clear. strlen("command") + strlen(path) doesn't account
for a terminating \0. This is (sometimes) detected in
src/cm/bionic/libc/stdio/__vsprintf_chk.c which calls abort.