commit 0cbac12083d70c3f27d4d6994342a3e650607e59
author Joshua Duong <joshuaduong@google.com> Fri May 31 11:31:14 2024 -0700
committer Joshua Duong <joshuaduong@google.com> Mon Jun 03 20:31:29 2024 +0000
tree 1d5d494efbb21d4f24a1280f99a7ee71c4703441
parent 6f6b803ae3d0229698fb1ed1b4d0a699c61cbea2

Fix ubsan error.

virtio can sometimes send a null iov (num_iovs=0). Don't give
memcpy a null pointer.

Bug: 339461355
Test: Boot emulator with ubsan
Change-Id: I3644e0280b0753159ff241825ca92b5929b6f14f

host/virtio-gpu-gfxstream-renderer.cpp

diff --git a/host/virtio-gpu-gfxstream-renderer.cpp b/host/virtio-gpu-gfxstream-renderer.cpp
index d2499d0..67f8d89 100644
--- a/host/virtio-gpu-gfxstream-renderer.cpp
+++ b/host/virtio-gpu-gfxstream-renderer.cpp
@@ -1483,7 +1483,7 @@
                 *max_size = sizeof(struct gfxstream::composerCapset);
                 break;
             default:
-                stream_renderer_error("Incorrect capability set specified");
+                stream_renderer_error("Incorrect capability set specified (%u)", set);
         }
     }
 
@@ -1893,9 +1893,11 @@
 
         if (linearSize) linear = malloc(linearSize);
 
-        entry.iov = (iovec*)malloc(sizeof(*iov) * num_iovs);
         entry.numIovs = num_iovs;
-        memcpy(entry.iov, iov, num_iovs * sizeof(*iov));
+        entry.iov = (iovec*)malloc(sizeof(*iov) * num_iovs);
+        if (entry.numIovs > 0) {
+            memcpy(entry.iov, iov, num_iovs * sizeof(*iov));
+        }
         entry.linear = linear;
         entry.linearSize = linearSize;
     }