Fix buffer overflow in trace_event_android.cc

BUG=552558
TEST=TraceEventAndroidTest.WriteToATrace

Review URL: https://codereview.chromium.org/1490763006

Cr-Commit-Position: refs/heads/master@{#362574}

4 files changed, 32 insertions, 1 deletions

diff --git a/base/trace_event/BUILD.gn b/base/trace_event/BUILD.gn
index aae6adb..85c26e2 100644
--- a/base/trace_event/BUILD.gn
+++ b/base/trace_event/BUILD.gn
@@ -135,6 +135,10 @@ source_set("trace_event_unittests") {
     sources += [ "process_memory_maps_dump_provider_unittest.cc" ]
   }
 
+  if (is_android) {
+    sources += [ "trace_event_android_unittest.cc" ]
+  }
+
   deps = [
     "//base/test:test_support",
     "//testing/gmock",
diff --git a/base/trace_event/trace_event.gypi b/base/trace_event/trace_event.gypi
index 0c43ae1..8656c6e 100644
--- a/base/trace_event/trace_event.gypi
+++ b/base/trace_event/trace_event.gypi
@@ -101,6 +101,11 @@
             'trace_event/process_memory_maps_dump_provider_unittest.cc',
           ],
       }],
+      ['OS == "android"', {
+        'trace_event_test_sources' : [
+          'trace_event/trace_event_android_unittest.cc',
+        ],
+      }],
     ],
   },
 }
diff --git a/base/trace_event/trace_event_android.cc b/base/trace_event/trace_event_android.cc
index 4e578a5..01ca8e4 100644
--- a/base/trace_event/trace_event_android.cc
+++ b/base/trace_event/trace_event_android.cc
@@ -25,7 +25,7 @@ void WriteToATrace(int fd, const char* buffer, size_t size) {
   size_t total_written = 0;
   while (total_written < size) {
     ssize_t written = HANDLE_EINTR(write(
-        fd, buffer + size, size - total_written));
+        fd, buffer + total_written, size - total_written));
     if (written <= 0)
       break;
     total_written += written;
diff --git a/base/trace_event/trace_event_android_unittest.cc b/base/trace_event/trace_event_android_unittest.cc
new file mode 100644
index 0000000..58bd77e
--- /dev/null
+++ b/base/trace_event/trace_event_android_unittest.cc
@@ -0,0 +1,22 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/trace_event/trace_event.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace base {
+namespace trace_event {
+
+TEST(TraceEventAndroidTest, WriteToATrace) {
+  // Just a smoke test to ensure no crash.
+  TraceLog* trace_log = TraceLog::GetInstance();
+  trace_log->StartATrace();
+  TRACE_EVENT0("test", "test-event");
+  trace_log->StopATrace();
+  trace_log->AddClockSyncMetadataEvent();
+}
+
+}  // namespace trace_event
+}  // namespace base