commit 4d1e5c78364ce5b97c39ffc1444c4d96bc2d73e3
author Wolloh Chou <wollohchou@google.com> Thu Mar 22 15:14:33 2018 +0800
committer Nathan Harold <nharold@google.com> Tue Mar 27 05:48:39 2018 -0700
tree a76e50c86333afb4c9f09c746000bd4a4e7df94b
parent 11670ca7eac3e611e9d5849dd5ef37d6fac70c57

Fix heap-buffer-overflow

Cast signed char to unsigned char to avoid sprintf doing sign extension
for %x.

Test: build
Bug: 75983919
Merged-In: I6685a77ac1c832d8dd83beafd7e463d56fab77d3
Change-Id: I6685a77ac1c832d8dd83beafd7e463d56fab77d3
(cherry picked from commit 9caabc0c0a82a8d65d62b2607d3d0e81ebe928f4)

server/XfrmController.cpp

diff --git a/server/XfrmController.cpp b/server/XfrmController.cpp
index cc2c305..52ffd7b 100644
--- a/server/XfrmController.cpp
+++ b/server/XfrmController.cpp
@@ -146,7 +146,7 @@
     offset += 8;
 
     for (uint32_t j = 0; j < (uint32_t)len; j++) {
-        sprintf(&printBuf[j * 2 + offset], "%0.2x", buf[j]);
+        sprintf(&printBuf[j * 2 + offset], "%0.2x", (unsigned char)buf[j]);
     }
     ALOGD("%s", printBuf);
     delete[] printBuf;