auto import from //branches/cupcake/...@132276

3 files changed, 26 insertions, 55 deletions

diff --git a/libc/bionic/logd.h b/libc/bionic/logd.h
deleted file mode 100644
index 671cb48..0000000
--- a/libc/bionic/logd.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#ifndef _ANDROID_BIONIC_LOGD_H
-#define _ANDROID_BIONIC_LOGD_H
-
-enum  {
-    ANDROID_LOG_UNKNOWN = 0,
-    ANDROID_LOG_DEFAULT,    /* only for SetMinPriority() */
-
-    ANDROID_LOG_VERBOSE,
-    ANDROID_LOG_DEBUG,
-    ANDROID_LOG_INFO,
-    ANDROID_LOG_WARN,
-    ANDROID_LOG_ERROR,
-    ANDROID_LOG_FATAL,
-
-    ANDROID_LOG_SILENT,     /* only for SetMinPriority(); must be last */
-};
-
-int __libc_android_log_print(int prio, const char *tag, const char *fmt, ...);
-
-#endif /* _ANDROID_BIONIC_LOGD_H */
diff --git a/libc/bionic/malloc_leak.c b/libc/bionic/malloc_leak.c
index 5ddc913..a0aa2ae 100644
--- a/libc/bionic/malloc_leak.c
+++ b/libc/bionic/malloc_leak.c
@@ -58,6 +58,8 @@
 #define SIZE_FLAG_ZYGOTE_CHILD  (1<<31)
 #define SIZE_FLAG_MASK          (SIZE_FLAG_ZYGOTE_CHILD)
 
+#define MAX_SIZE_T           (~(size_t)0)
+
 /*
  * In a VM process, this is set to 1 after fork()ing out of zygote.
  */
@@ -608,8 +610,16 @@ void  chk_free(void* mem)
 
 void* chk_calloc(size_t n_elements, size_t elem_size)
 {
-    size_t size = n_elements * elem_size;
-    void* ptr = chk_malloc(size);
+    size_t  size;
+    void*   ptr;
+
+    /* Fail on overflow - just to be safe even though this code runs only
+     * within the debugging C library, not the production one */
+    if (n_elements && MAX_SIZE_T / n_elements < elem_size) {
+        return NULL;
+    }
+    size = n_elements * elem_size;
+    ptr  = chk_malloc(size);
     if (ptr != NULL) {
         memset(ptr, 0, size);
     }
@@ -763,8 +773,16 @@ void leak_free(void* mem)
 
 void* leak_calloc(size_t n_elements, size_t elem_size)
 {
-    size_t size = n_elements * elem_size;
-    void* ptr = leak_malloc(size);
+    size_t  size;
+    void*   ptr;
+
+    /* Fail on overflow - just to be safe even though this code runs only
+     * within the debugging C library, not the production one */
+    if (n_elements && MAX_SIZE_T / n_elements < elem_size) {
+        return NULL;
+    }
+    size = n_elements * elem_size;
+    ptr  = leak_malloc(size);
     if (ptr != NULL) {
         memset(ptr, 0, size);
     }
diff --git a/libc/bionic/pthread-timers.c b/libc/bionic/pthread-timers.c
index b8f7488..818b47d 100644
--- a/libc/bionic/pthread-timers.c
+++ b/libc/bionic/pthread-timers.c
@@ -469,7 +469,7 @@ timer_settime( timer_t                   id,
     }
 
     if ( __likely(!TIMER_ID_IS_WRAPPED(id)) ) {
-        return __timer_gettime( id, ospec );
+        return __timer_settime( id, flags, spec, ospec );
     } else {
         thr_timer_t*        timer = thr_timer_from_id(id);
         struct timespec     expires, now;
@@ -560,11 +560,11 @@ timer_thread_start( void*  _arg )
         if (timespec_cmp( &expires, &now ) > 0)
         {
             /* cool, there was no overrun, so compute the
-             * relative timeout as 'now - expires', then wait
+             * relative timeout as 'expires - now', then wait
              */
             int              ret;
-            struct timespec  diff = now;
-            timespec_sub( &diff, &expires );
+            struct timespec  diff = expires;
+            timespec_sub( &diff, &now );
 
             ret = __pthread_cond_timedwait_relative(
                         &timer->cond, &timer->mutex, &diff);