userd: fix userspace buffer overflow when redirecting and restoring rc file

[fanuverse]

Summary

Fix out-of-bounds heap write in openat hook caused by using array sizeof instead of string length, which corrupted Scudo chunk headers in Android 14 init.

---

Problem

In after_openat(), compat_copy_to_user passed sizeof(ORIGIN_RC_FILES[args->local.data3 - 1]) as the copy length. Because ORIGIN_RC_FILES is declared as const char [][64], sizeof evaluates to 64 bytes (0x40) rather than the actual string length.

When userspace (/system/bin/init) opens /system/etc/init/hw/init.rc (28 bytes with null terminator), LLVM libc++ allocates a heap buffer of ~32 bytes (as it exceeds the 23-byte SSO limit). Copying 64 bytes back into userspace causes an out-of-bounds 32-byte heap write into adjacent memory, corrupting Scudo allocator chunk headers and triggering an immediate SIGSEGV during init::Parser::ParseData() on Android 14.

Solution

1. Restore exact string bounds in after_openat(): Copy strlen(origin_rc) + 1 bytes instead of sizeof(ORIGIN_RC_FILES[...]).
2. Guard in-place overwrite in before_openat(): Verify strlen(origin_rc) + 1 >= sizeof(REPLACE_RC_FILE) before attempting an in-place compat_copy_to_user, safely falling back to copy_to_user_stack() for shorter targets like /init.rc (9 bytes).

How Has This Been Tested?

• Boot tested on Android 14 target device.
• Verified /system/bin/init successfully parses /system/etc/init/hw/init.rc without Scudo crashes.
• Verified shorter paths (e.g. /init.rc) fall back to stack copy without overflow.