VectorImpl.cpp: fix benign multiplication overflow
j is a ssize_t, which can go negative. If it goes negative,
the resulting multiplication of mItemSize*j doesn't make
any sense. Since the value is never used, just don't perform
the calculation if j < 0.
Bug: 23607865
Change-Id: I14f6f6506645d582f7d67a2e2d60ead3cb18b957
diff --git a/libutils/VectorImpl.cpp b/libutils/VectorImpl.cpp
index bdb54b1..2f770f5 100644
--- a/libutils/VectorImpl.cpp
+++ b/libutils/VectorImpl.cpp
@@ -198,7 +198,10 @@
_do_copy(next, curr, 1);
next = curr;
--j;
- curr = reinterpret_cast<char*>(array) + mItemSize*(j);
+ curr = NULL;
+ if (j >= 0) {
+ curr = reinterpret_cast<char*>(array) + mItemSize*(j);
+ }
} while (j>=0 && (cmp(curr, temp, state) > 0));
_do_destroy(next, 1);