From e15d7a5104978cd8399501636aec0df9c1a4823c Mon Sep 17 00:00:00 2001 From: Tao Bao Date: Thu, 7 Sep 2017 13:38:51 -0700 Subject: ui: Manage menu_ with std::vector. Prior to this CL, menu_ is allocated with a fixed length of text_rows_. However, because we support scrollable menu in wear_ui, there might be more menu entries than text_rows_, which would lead to out-of-bounds array access. This CL addresses the issue by switching to std::vector. Bug: 65416558 Test: Run 'View recovery logs' on angler. Test: Set large margin height that leaves text_rows less than 21. Then run 'View recovery logs' with 21 menu entries. Change-Id: I5d4e3a0a097039e1104eda7d494c6269053dc894 --- screen_ui.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'screen_ui.h') diff --git a/screen_ui.h b/screen_ui.h index 62dda755..8231a2ba 100644 --- a/screen_ui.h +++ b/screen_ui.h @@ -21,6 +21,7 @@ #include #include +#include #include "ui.h" @@ -127,7 +128,7 @@ class ScreenRecoveryUI : public RecoveryUI { bool show_text; bool show_text_ever; // has show_text ever been true? - char** menu_; + std::vector menu_; const char* const* menu_headers_; bool show_menu; int menu_items, menu_sel; -- cgit v1.2.3-54-g00ecf