Fix temporary file name strlcpy size.
The strlcpy size argument overflows on integer sanitized builds. runtime error: unsigned integer overflow: 11 - 35 cannot be represented in type 'unsigned long' This doesn't cause a problem because strlcpy stops on the null in TMP_FILE_PATTERN, and localTmpFileName is defined large enough to contain TMP_FILE_PATTERN. This changes the size argument to the remaining length in the buffer, and removes an extraneous '/' write as TMP_FILE_PATTERN already begins with '/'. Bug: 30969751 Test: Reran CTS test which triggered the overflow. Change-Id: I20b5deeaaa1a863324dfd1d94f3135920eae48d3 Merged-In: I20b5deeaaa1a863324dfd1d94f3135920eae48d2 (cherry picked from commit 62fc1489)
Loading
Please register or sign in to comment