From 2b1f82e1c87d1170129dbf202cb1b99c4f85e27b Mon Sep 17 00:00:00 2001
From: "ivan.penkov@gmail.com"
 <ivan.penkov@gmail.com@4c0a9323-5329-0410-9bdc-e9ce6186880e>
Date: Tue, 21 May 2013 17:05:35 +0000
Subject: [PATCH] Fixing several instances of std::vector::operator[] out of
 range access Review URL: https://breakpad.appspot.com/597002

git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1187 4c0a9323-5329-0410-9bdc-e9ce6186880e
---
 src/client/linux/minidump_writer/linux_dumper.cc |  9 ++++++---
 .../linux/minidump_writer/minidump_writer.cc     | 16 ++++++++++------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/src/client/linux/minidump_writer/linux_dumper.cc b/src/client/linux/minidump_writer/linux_dumper.cc
index e5a341ca..e09da916 100644
--- a/src/client/linux/minidump_writer/linux_dumper.cc
+++ b/src/client/linux/minidump_writer/linux_dumper.cc
@@ -77,6 +77,9 @@ LinuxDumper::LinuxDumper(pid_t pid)
       threads_(&allocator_, 8),
       mappings_(&allocator_),
       auxv_(&allocator_, AT_MAX + 1) {
+  // The passed-in size to the constructor (above) is only a hint.
+  // Must call .resize() to do actual initialization of the elements.
+  auxv_.resize(AT_MAX + 1);
 }
 
 LinuxDumper::~LinuxDumper() {
@@ -90,8 +93,7 @@ bool
 LinuxDumper::ElfFileIdentifierForMapping(const MappingInfo& mapping,
                                          bool member,
                                          unsigned int mapping_id,
-                                         uint8_t identifier[sizeof(MDGUID)])
-{
+                                         uint8_t identifier[sizeof(MDGUID)]) {
   assert(!member || mapping_id < mappings_.size());
   my_memset(identifier, 0, sizeof(MDGUID));
   if (IsMappedFileOpenUnsafe(mapping))
@@ -273,7 +275,8 @@ bool LinuxDumper::GetStackInfo(const void** stack, size_t* stack_len,
   const MappingInfo* mapping = FindMapping(stack_pointer);
   if (!mapping)
     return false;
-  const ptrdiff_t offset = stack_pointer - (uint8_t*) mapping->start_addr;
+  const ptrdiff_t offset = stack_pointer -
+      reinterpret_cast<uint8_t*>(mapping->start_addr);
   const ptrdiff_t distance_to_end =
       static_cast<ptrdiff_t>(mapping->size) - offset;
   *stack_len = distance_to_end > kStackToCapture ?
diff --git a/src/client/linux/minidump_writer/minidump_writer.cc b/src/client/linux/minidump_writer/minidump_writer.cc
index 76c6e5a6..2cbf4352 100644
--- a/src/client/linux/minidump_writer/minidump_writer.cc
+++ b/src/client/linux/minidump_writer/minidump_writer.cc
@@ -1127,8 +1127,8 @@ class MinidumpWriter {
           return false;
         MDRawLinkMap entry;
         entry.name = location.rva;
-        entry.addr = (void*)map.l_addr;
-        entry.ld = (void*)map.l_ld;
+        entry.addr = reinterpret_cast<void*>(map.l_addr);
+        entry.ld = reinterpret_cast<void*>(map.l_ld);
         linkmap.CopyIndex(idx++, &entry);
       }
     }
@@ -1144,11 +1144,14 @@ class MinidumpWriter {
     debug.get()->version = debug_entry.r_version;
     debug.get()->map = linkmap_rva;
     debug.get()->dso_count = dso_count;
-    debug.get()->brk = (void*)debug_entry.r_brk;
-    debug.get()->ldbase = (void*)debug_entry.r_ldbase;
+    debug.get()->brk = reinterpret_cast<void*>(debug_entry.r_brk);
+    debug.get()->ldbase = reinterpret_cast<void*>(debug_entry.r_ldbase);
     debug.get()->dynamic = dynamic;
 
     wasteful_vector<char> dso_debug_data(dumper_->allocator(), dynamic_length);
+    // The passed-in size to the constructor (above) is only a hint.
+    // Must call .resize() to do actual initialization of the elements.
+    dso_debug_data.resize(dynamic_length);
     dumper_->CopyFromProcess(&dso_debug_data[0], GetCrashThread(), dynamic,
                              dynamic_length);
     debug.CopyIndexAfterObject(0, &dso_debug_data[0], dynamic_length);
@@ -1420,10 +1423,11 @@ class MinidumpWriter {
           const char* p = value;
           if (value[0] == '0' && value[1] == 'x') {
             p = my_read_hex_ptr(&result, value+2);
-          } else if (entry->format == 'x')
+          } else if (entry->format == 'x') {
             p = my_read_hex_ptr(&result, value);
-          else
+          } else {
             p = my_read_decimal_ptr(&result, value);
+          }
           if (p == value)
             continue;