commit 851c62d45c9b26d73d50430ace563b40e5adce3f
author Greg Kaiser <gkaiser@google.com> Thu Jun 02 05:30:32 2022 -0700
committer Greg Kaiser <gkaiser@google.com> Thu Jun 02 05:30:32 2022 -0700
tree 1c9e9df507449dd2fe845dccfe6a8e8707807f3d
parent e094dce240f55aaaa7538d9cabdba1871feac7de

Grab pointer into array post-resize()

This is a defensive change.  The current code is safe due to the
resize() which happens 30 lines above this one.  However, if that
resize() were to change or disappear, then this code would be
dangerous, as the resize() could potentially cause a reallocation,
and move our memory buffer.

Since it's no additional cost to grab the pointer into the
array after the resize(), we do that.

Bug: 232940948
Test: TreeHugger
Change-Id: I29b6cbeb064c7654eb21d2e42e05a0587604c32b

libs/androidfw/Util.cpp

diff --git a/libs/androidfw/Util.cpp b/libs/androidfw/Util.cpp
index be9edc4..52ad0dc 100644
--- a/libs/androidfw/Util.cpp
+++ b/libs/androidfw/Util.cpp
@@ -151,8 +151,9 @@
         }
 
         // Encode the UTF-8 representation of the codepoint into the string
-        char* start = &output[output.size()];
-        output.resize(output.size() + utf8_length);
+        const size_t start_index = output.size();
+        output.resize(start_index + utf8_length);
+        char* start = &output[start_index];
         utf32_to_utf8((char32_t*)&codepoint, 1, start, utf8_length + 1);
 
         index = next_index;