DO NOT MERGE: Fix use-after-free of interface name during network destruction.

bug:15560990

Change-Id: I899827c4f50847a3a60b6359f829bee5d6eb4f00
(cherry picked from commit 6ff16785ae1f67f44a73ad00d6c86690af6772d2)

1 files changed, 8 insertions, 2 deletions

diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index 4e211142..a32dd670 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -36,6 +36,10 @@
 #include "RouteController.h"
 
 #define LOG_TAG "NetworkController"
+
+#include <sys/socket.h>
+#include <linux/if.h>
+
 #include "cutils/log.h"
 #include "resolv_netid.h"
 
@@ -273,9 +277,11 @@ bool NetworkController::destroyNetwork(unsigned netId) {
 
     InterfaceRange range = mNetIdToInterfaces.equal_range(netId);
     for (InterfaceIteratorConst iter = range.first; iter != range.second; ) {
-        InterfaceIteratorConst toErase = iter;
+        char interface[IFNAMSIZ];
+        strncpy(interface, iter->second.c_str(), sizeof(interface));
+        interface[sizeof(interface) - 1] = 0;
         ++iter;
-        if (!removeInterfaceFromNetwork(netId, toErase->second.c_str())) {
+        if (!removeInterfaceFromNetwork(netId, interface)) {
             status = false;
         }
     }