Code:  static void print_maps(struct pid_info_t* info)
 {
     FILE *maps;
     size_t offset;
     char device[10];
     long int inode;
    char file[PATH_MAX];
 
     strlcat(info->path, "maps", sizeof(info->path));
 
    maps = fopen(info->path, "r");

     if (!maps)
         goto out;
 
    while (fscanf(maps, "%*x-%*x %*s %zx %s %ld %s\n", &offset, device, &inode,
            file) == 4) {
         if (inode == 0 || !strcmp(device, "00:00"))
             continue;

        printf("%-9s %5d %10s %4s %9s %18s %9zd %10ld %s\n",
                info->cmdline, info->pid, info->user, "mem",
 "???", device, offset, inode, file);
 }

    fclose(maps);

out:
    info->path[info->parent_length] = '\0';
}

Vulnerability Type: +Priv 
CWE ID: CWE-20
Summary: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.
Commit Message: Fix scanf %s in lsof.

Bug: http://b/28175237
Change-Id: Ief0ba299b09693ad9afc0e3d17a8f664c2fbb8c2
