commit c367d48c55e5a3fa0df14fd62889e4bb6b63cb01
author Elliott Hughes <enh@google.com> Tue Oct 29 13:12:55 2013 -0700
committer Elliott Hughes <enh@google.com> Tue Oct 29 13:12:55 2013 -0700
tree cc6a7e56e5c5e74d66603c8170660fd99c52bff3
parent b4cae4a955ebd91cf35aaeb00ab12ce6f1d5fc48

Fix a variety of small publicly-reported bugs.

Possible NULL dereference in cmds/bootanimation/BootAnimation.cpp.
https://code.google.com/p/android/issues/detail?id=61556

Missing fclose in core/jni/android_os_Debug.cpp.
https://code.google.com/p/android/issues/detail?id=61546

Bad loop guards in core/jni/android_util_Process.cpp.
https://code.google.com/p/android/issues/detail?id=61557

Assignment to wrong variable in libs/androidfw/AssetManager.cpp.
https://code.google.com/p/android/issues/detail?id=61560

Missing delete[]s in libs/androidfw/ObbFile.cpp.
https://code.google.com/p/android/issues/detail?id=61549

Leaks on error in tools/aapt/Images.cpp.
https://code.google.com/p/android/issues/detail?id=61552

Two missing fclose calls in tools/aapt/Resource.cpp.
https://code.google.com/p/android/issues/detail?id=61553

Missing fclose in tools/aidl/aidl.cpp.
https://code.google.com/p/android/issues/detail?id=61554

Change-Id: I5820f3824e72d07a9acb776cf0af3e7443f5694a

core/jni/android_os_Debug.cpp

diff --git a/core/jni/android_os_Debug.cpp b/core/jni/android_os_Debug.cpp
index 2883c10..7720389 100644
--- a/core/jni/android_os_Debug.cpp
+++ b/core/jni/android_os_Debug.cpp
@@ -335,6 +335,7 @@
     // loop until we have the block that represents this process
     do {
         if (fgets(line, 1024, fp) == 0) {
+            fclose(fp);
             return -1;
         }
     } while (strncmp(compare, line, len));
@@ -344,13 +345,16 @@
 
     do {
         if (fgets(line, 1024, fp) == 0) {
+            fclose(fp);
             return -1;
         }
     } while (strncmp(compare, line, len));
 
     // we have the line, now increment the line ptr to the value
     char* ptr = line + len;
-    return atoi(ptr);
+    jint result = atoi(ptr);
+    fclose(fp);
+    return result;
 }
 
 static jint android_os_Debug_getBinderSentTransactions(JNIEnv *env, jobject clazz)

core/jni/android_util_Process.cpp

diff --git a/core/jni/android_util_Process.cpp b/core/jni/android_util_Process.cpp
index 607c429..43a5859 100644
--- a/core/jni/android_util_Process.cpp
+++ b/core/jni/android_util_Process.cpp
@@ -395,7 +395,7 @@
     return *((const jint*)v1) - *((const jint*)v2);
 }
 
-static jlong getFreeMemoryImpl(const char* const sums[], const int sumsLen[], int num)
+static jlong getFreeMemoryImpl(const char* const sums[], const size_t sumsLen[], size_t num)
 {
     int fd = open("/proc/meminfo", O_RDONLY);
 
@@ -414,7 +414,7 @@
     }
     buffer[len] = 0;
 
-    int numFound = 0;
+    size_t numFound = 0;
     jlong mem = 0;
 
     char* p = buffer;
@@ -446,14 +446,14 @@
 static jlong android_os_Process_getFreeMemory(JNIEnv* env, jobject clazz)
 {
     static const char* const sums[] = { "MemFree:", "Cached:", NULL };
-    static const int sumsLen[] = { strlen("MemFree:"), strlen("Cached:"), 0 };
+    static const size_t sumsLen[] = { strlen("MemFree:"), strlen("Cached:"), 0 };
     return getFreeMemoryImpl(sums, sumsLen, 2);
 }
 
 static jlong android_os_Process_getTotalMemory(JNIEnv* env, jobject clazz)
 {
     static const char* const sums[] = { "MemTotal:", NULL };
-    static const int sumsLen[] = { strlen("MemTotal:"), 0 };
+    static const size_t sumsLen[] = { strlen("MemTotal:"), 0 };
     return getFreeMemoryImpl(sums, sumsLen, 1);
 }
 
@@ -711,13 +711,13 @@
 
         jsize end = -1;
         if ((mode&PROC_PARENS) != 0) {
-            while (buffer[i] != ')' && i < endIndex) {
+            while (i < endIndex && buffer[i] != ')') {
                 i++;
             }
             end = i;
             i++;
         }
-        while (buffer[i] != term && i < endIndex) {
+        while (i < endIndex && buffer[i] != term) {
             i++;
         }
         if (end < 0) {
@@ -727,7 +727,7 @@
         if (i < endIndex) {
             i++;
             if ((mode&PROC_COMBINE) != 0) {
-                while (buffer[i] == term && i < endIndex) {
+                while (i < endIndex && buffer[i] == term) {
                     i++;
                 }
             }