12 files changed, 783 insertions, 811 deletions

diff --git a/applypatch/Android.mk b/applypatch/Android.mk
index 2cce81f6d..48eab014e 100644
--- a/applypatch/Android.mk
+++ b/applypatch/Android.mk
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 LOCAL_PATH := $(call my-dir)
+
 include $(CLEAR_VARS)
 
 BOARD_RECOVERY_DEFINES := BOARD_BML_BOOT BOARD_BML_RECOVERY
@@ -23,47 +24,55 @@ $(foreach board_define,$(BOARD_RECOVERY_DEFINES), \
   ) \
   )
 
-LOCAL_SRC_FILES := applypatch.c bspatch.c freecache.c imgpatch.c utils.c
-LOCAL_MODULE := libapplypatch
-LOCAL_MODULE_TAGS := eng
 LOCAL_C_INCLUDES += \
     external/bzip2 \
     external/zlib \
     $(commands_recovery_local_path)
-LOCAL_STATIC_LIBRARIES += libmtdutils libmincrypttwrp libbz libz
+
+LOCAL_CLANG := true
+LOCAL_SRC_FILES := applypatch.cpp bspatch.cpp freecache.cpp imgpatch.cpp utils.cpp
+LOCAL_MODULE := libapplypatch
+LOCAL_MODULE_TAGS := eng
+LOCAL_C_INCLUDES += bootable/recovery
+LOCAL_STATIC_LIBRARIES += libbase libotafault libmtdutils libmincrypttwrp libbz libz
 
 include $(BUILD_STATIC_LIBRARY)
 
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES := main.c
-LOCAL_MODULE := applypatch
-LOCAL_MODULE_TAGS := optional
-LOCAL_C_INCLUDES += $(commands_recovery_local_path)
-LOCAL_STATIC_LIBRARIES += libapplypatch libmtdutils libmincrypttwrp libbz
-LOCAL_SHARED_LIBRARIES += libz libcutils libstdc++ libc
+ifeq ($(HOST_OS),linux)
+include $(CLEAR_VARS)
 
-include $(BUILD_EXECUTABLE)
+LOCAL_CLANG := true
+LOCAL_SRC_FILES := bspatch.cpp imgpatch.cpp utils.cpp
+LOCAL_MODULE := libimgpatch
+LOCAL_C_INCLUDES += bootable/recovery
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
+LOCAL_STATIC_LIBRARIES += libcrypto_static libbz libz
+
+include $(BUILD_HOST_STATIC_LIBRARY)
+endif  # HOST_OS == linux
 
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES := main.c
-LOCAL_MODULE := applypatch_static
-LOCAL_FORCE_STATIC_EXECUTABLE := true
-LOCAL_MODULE_TAGS := optional eng
-LOCAL_C_INCLUDES += $(commands_recovery_local_path)
-LOCAL_STATIC_LIBRARIES += libapplypatch libmtdutils libmincrypttwrp libbz
-LOCAL_STATIC_LIBRARIES += libz libcutils libstdc++ libc
+LOCAL_CLANG := true
+LOCAL_SRC_FILES := main.cpp
+LOCAL_MODULE := applypatch
+LOCAL_C_INCLUDES += bootable/recovery
+LOCAL_STATIC_LIBRARIES += libapplypatch libbase libotafault libmtdutils libcrypto_static libbz \
+                          libedify \
+
+LOCAL_SHARED_LIBRARIES += libz libcutils libc
 
 include $(BUILD_EXECUTABLE)
 
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES := imgdiff.c utils.c bsdiff.c
+LOCAL_CLANG := true
+LOCAL_SRC_FILES := imgdiff.cpp utils.cpp bsdiff.cpp
 LOCAL_MODULE := imgdiff
 LOCAL_FORCE_STATIC_EXECUTABLE := true
 LOCAL_C_INCLUDES += external/zlib external/bzip2
 LOCAL_STATIC_LIBRARIES += libz libbz
-LOCAL_MODULE_TAGS := eng
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/applypatch/applypatch.c b/applypatch/applypatch.cpp
index bc45e3c45..cc2858551 100644
--- a/applypatch/applypatch.c
+++ b/applypatch/applypatch.cpp
@@ -15,6 +15,7 @@
  */
 
 #include <errno.h>
+#include <fcntl.h>
 #include <libgen.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -22,15 +23,20 @@
 #include <sys/stat.h>
 #include <sys/statfs.h>
 #include <sys/types.h>
-#include <fcntl.h>
 #include <unistd.h>
-#include <stdbool.h>
 
-#include "mincrypt/sha.h"
+#include <memory>
+#include <string>
+
+#include <android-base/strings.h>
+
+#include "openssl/sha.h"
 #include "applypatch.h"
 #include "bmlutils/bmlutils.h"
 #include "mtdutils/mtdutils.h"
 #include "edify/expr.h"
+#include "ota_io.h"
+#include "print_sha1.h"
 
 static int LoadPartitionContents(const char* filename, FileContents* file);
 static ssize_t FileSink(const unsigned char* data, ssize_t len, void* token);
@@ -40,19 +46,17 @@ static int GenerateTarget(FileContents* source_file,
                           const Value* copy_patch_value,
                           const char* source_filename,
                           const char* target_filename,
-                          const uint8_t target_sha1[SHA_DIGEST_SIZE],
+                          const uint8_t target_sha1[SHA_DIGEST_LENGTH],
                           size_t target_size,
                           const Value* bonus_data);
 
-static int mtd_partitions_scanned = 0;
+static bool mtd_partitions_scanned = false;
 
 // Read a file into memory; store the file contents and associated
 // metadata in *file.
 //
 // Return 0 on success.
 int LoadFileContents(const char* filename, FileContents* file) {
-    file->data = NULL;
-
     // A special 'filename' beginning with "MTD:" or "EMMC:" means to
     // load the contents of a partition.
     if (strncmp(filename, "MTD:", 4) == 0 ||
@@ -66,46 +70,25 @@ int LoadFileContents(const char* filename, FileContents* file) {
         return -1;
     }
 
-    file->size = file->st.st_size;
-    file->data = malloc(file->size);
-
-    FILE* f = fopen(filename, "rb");
+    std::vector<unsigned char> data(file->st.st_size);
+    FILE* f = ota_fopen(filename, "rb");
     if (f == NULL) {
         printf("failed to open \"%s\": %s\n", filename, strerror(errno));
-        free(file->data);
-        file->data = NULL;
         return -1;
     }
 
-    ssize_t bytes_read = fread(file->data, 1, file->size, f);
-    if (bytes_read != file->size) {
-        printf("short read of \"%s\" (%ld bytes of %ld)\n",
-               filename, (long)bytes_read, (long)file->size);
-        free(file->data);
-        file->data = NULL;
+    size_t bytes_read = ota_fread(data.data(), 1, data.size(), f);
+    if (bytes_read != data.size()) {
+        printf("short read of \"%s\" (%zu bytes of %zd)\n", filename, bytes_read, data.size());
+        ota_fclose(f);
         return -1;
     }
-    fclose(f);
-
-    SHA_hash(file->data, file->size, file->sha1);
+    ota_fclose(f);
+    file->data = std::move(data);
+    SHA1(file->data.data(), file->data.size(), file->sha1);
     return 0;
 }
 
-static size_t* size_array;
-// comparison function for qsort()ing an int array of indexes into
-// size_array[].
-static int compare_size_indices(const void* a, const void* b) {
-    int aa = *(int*)a;
-    int bb = *(int*)b;
-    if (size_array[aa] < size_array[bb]) {
-        return -1;
-    } else if (size_array[aa] > size_array[bb]) {
-        return 1;
-    } else {
-        return 0;
-    }
-}
-
 // Load the contents of an MTD or EMMC partition into the provided
 // FileContents.  filename should be a string of the form
 // "MTD:<partition_name>:<size_1>:<sha1_1>:<size_2>:<sha1_2>:..."  (or
@@ -124,23 +107,25 @@ static int compare_size_indices(const void* a, const void* b) {
 enum PartitionType { MTD, EMMC };
 
 static int LoadPartitionContents(const char* filename, FileContents* file) {
-    char* copy = strdup(filename);
-    const char* magic = strtok(copy, ":");
+    std::string copy(filename);
+    std::vector<std::string> pieces = android::base::Split(copy, ":");
+    if (pieces.size() < 4 || pieces.size() % 2 != 0) {
+        printf("LoadPartitionContents called with bad filename (%s)\n", filename);
+        return -1;
+    }
 
     enum PartitionType type;
-
-    if (strcmp(magic, "MTD") == 0) {
+    if (pieces[0] == "MTD") {
         type = MTD;
-    } else if (strcmp(magic, "EMMC") == 0) {
+    } else if (pieces[0] == "EMMC") {
         type = EMMC;
     } else if (strcmp(magic, "BML") == 0) {
         type = EMMC;
     } else {
-        printf("LoadPartitionContents called with bad filename (%s)\n",
-               filename);
+        printf("LoadPartitionContents called with bad filename (%s)\n", filename);
         return -1;
     }
-    const char* partition = strtok(NULL, ":");
+    const char* partition = pieces[1].c_str();
 
     if (strcmp(magic, "BML") == 0) {
         if (strcmp(partition, "boot") == 0) {
@@ -150,132 +135,115 @@ static int LoadPartitionContents(const char* filename, FileContents* file) {
         }
     }
 
-    int i;
-    int colons = 0;
-    for (i = 0; filename[i] != '\0'; ++i) {
-        if (filename[i] == ':') {
-            ++colons;
-        }
-    }
-    if (colons < 3 || colons%2 == 0) {
-        printf("LoadPartitionContents called with bad filename (%s)\n",
-               filename);
-    }
-
-    int pairs = (colons-1)/2;     // # of (size,sha1) pairs in filename
-    int* index = malloc(pairs * sizeof(int));
-    size_t* size = malloc(pairs * sizeof(size_t));
-    char** sha1sum = malloc(pairs * sizeof(char*));
+    size_t pairs = (pieces.size() - 2) / 2;    // # of (size, sha1) pairs in filename
+    std::vector<size_t> index(pairs);
+    std::vector<size_t> size(pairs);
+    std::vector<std::string> sha1sum(pairs);
 
-    for (i = 0; i < pairs; ++i) {
-        const char* size_str = strtok(NULL, ":");
-        size[i] = strtol(size_str, NULL, 10);
+    for (size_t i = 0; i < pairs; ++i) {
+        size[i] = strtol(pieces[i*2+2].c_str(), NULL, 10);
         if (size[i] == 0) {
             printf("LoadPartitionContents called with bad size (%s)\n", filename);
             return -1;
         }
-        sha1sum[i] = strtok(NULL, ":");
+        sha1sum[i] = pieces[i*2+3].c_str();
         index[i] = i;
     }
 
-    // sort the index[] array so it indexes the pairs in order of
-    // increasing size.
-    size_array = size;
-    qsort(index, pairs, sizeof(int), compare_size_indices);
+    // Sort the index[] array so it indexes the pairs in order of increasing size.
+    sort(index.begin(), index.end(),
+        [&](const size_t& i, const size_t& j) {
+            return (size[i] < size[j]);
+        }
+    );
 
     MtdReadContext* ctx = NULL;
     FILE* dev = NULL;
 
     switch (type) {
-        case MTD:
+        case MTD: {
             if (!mtd_partitions_scanned) {
                 mtd_scan_partitions();
-                mtd_partitions_scanned = 1;
+                mtd_partitions_scanned = true;
             }
 
             const MtdPartition* mtd = mtd_find_partition_by_name(partition);
             if (mtd == NULL) {
-                printf("mtd partition \"%s\" not found (loading %s)\n",
-                       partition, filename);
+                printf("mtd partition \"%s\" not found (loading %s)\n", partition, filename);
                 return -1;
             }
 
             ctx = mtd_read_partition(mtd);
             if (ctx == NULL) {
-                printf("failed to initialize read of mtd partition \"%s\"\n",
-                       partition);
+                printf("failed to initialize read of mtd partition \"%s\"\n", partition);
                 return -1;
             }
             break;
+        }
 
         case EMMC:
-            dev = fopen(partition, "rb");
+            dev = ota_fopen(partition, "rb");
             if (dev == NULL) {
-                printf("failed to open emmc partition \"%s\": %s\n",
-                       partition, strerror(errno));
+                printf("failed to open emmc partition \"%s\": %s\n", partition, strerror(errno));
                 return -1;
             }
     }
 
     SHA_CTX sha_ctx;
-    SHA_init(&sha_ctx);
-    uint8_t parsed_sha[SHA_DIGEST_SIZE];
-
-    // allocate enough memory to hold the largest size.
-    file->data = malloc(size[index[pairs-1]]);
-    char* p = (char*)file->data;
-    file->size = 0;                // # bytes read so far
-
-    for (i = 0; i < pairs; ++i) {
-        // Read enough additional bytes to get us up to the next size
-        // (again, we're trying the possibilities in order of increasing
-        // size).
-        size_t next = size[index[i]] - file->size;
-        size_t read = 0;
+    SHA1_Init(&sha_ctx);
+    uint8_t parsed_sha[SHA_DIGEST_LENGTH];
+
+    // Allocate enough memory to hold the largest size.
+    std::vector<unsigned char> data(size[index[pairs-1]]);
+    char* p = reinterpret_cast<char*>(data.data());
+    size_t data_size = 0;                // # bytes read so far
+    bool found = false;
+
+    for (size_t i = 0; i < pairs; ++i) {
+        // Read enough additional bytes to get us up to the next size. (Again,
+        // we're trying the possibilities in order of increasing size).
+        size_t next = size[index[i]] - data_size;
         if (next > 0) {
+            size_t read = 0;
             switch (type) {
                 case MTD:
                     read = mtd_read_data(ctx, p, next);
                     break;
 
                 case EMMC:
-                    read = fread(p, 1, next, dev);
+                    read = ota_fread(p, 1, next, dev);
                     break;
             }
             if (next != read) {
                 printf("short read (%zu bytes of %zu) for partition \"%s\"\n",
                        read, next, partition);
-                free(file->data);
-                file->data = NULL;
                 return -1;
             }
-            SHA_update(&sha_ctx, p, read);
-            file->size += read;
+            SHA1_Update(&sha_ctx, p, read);
+            data_size += read;
+            p += read;
         }
 
         // Duplicate the SHA context and finalize the duplicate so we can
         // check it against this pair's expected hash.
         SHA_CTX temp_ctx;
         memcpy(&temp_ctx, &sha_ctx, sizeof(SHA_CTX));
-        const uint8_t* sha_so_far = SHA_final(&temp_ctx);
+        uint8_t sha_so_far[SHA_DIGEST_LENGTH];
+        SHA1_Final(sha_so_far, &temp_ctx);
 
-        if (ParseSha1(sha1sum[index[i]], parsed_sha) != 0) {
-            printf("failed to parse sha1 %s in %s\n",
-                   sha1sum[index[i]], filename);
-            free(file->data);
-            file->data = NULL;
+        if (ParseSha1(sha1sum[index[i]].c_str(), parsed_sha) != 0) {
+            printf("failed to parse sha1 %s in %s\n", sha1sum[index[i]].c_str(), filename);
             return -1;
         }
 
-        if (memcmp(sha_so_far, parsed_sha, SHA_DIGEST_SIZE) == 0) {
+        if (memcmp(sha_so_far, parsed_sha, SHA_DIGEST_LENGTH) == 0) {
             // we have a match.  stop reading the partition; we'll return
             // the data we've read so far.
             printf("partition read matched size %zu sha %s\n",
-                   size[index[i]], sha1sum[index[i]]);
+                   size[index[i]], sha1sum[index[i]].c_str());
+            found = true;
             break;
         }
-
-        p += read;
     }
 
     switch (type) {
@@ -284,36 +252,26 @@ static int LoadPartitionContents(const char* filename, FileContents* file) {
             break;
 
         case EMMC:
-            fclose(dev);
+            ota_fclose(dev);
             break;
     }
 
 
-    if (i == pairs) {
-        // Ran off the end of the list of (size,sha1) pairs without
-        // finding a match.
-        printf("contents of partition \"%s\" didn't match %s\n",
-               partition, filename);
-        free(file->data);
-        file->data = NULL;
+    if (!found) {
+        // Ran off the end of the list of (size,sha1) pairs without finding a match.
+        printf("contents of partition \"%s\" didn't match %s\n", partition, filename);
         return -1;
     }
 
-    const uint8_t* sha_final = SHA_final(&sha_ctx);
-    for (i = 0; i < SHA_DIGEST_SIZE; ++i) {
-        file->sha1[i] = sha_final[i];
-    }
+    SHA1_Final(file->sha1, &sha_ctx);
 
+    data.resize(data_size);
+    file->data = std::move(data);
     // Fake some stat() info.
     file->st.st_mode = 0644;
     file->st.st_uid = 0;
     file->st.st_gid = 0;
 
-    free(copy);
-    free(index);
-    free(size);
-    free(sha1sum);
-
     return 0;
 }
 
@@ -321,26 +279,24 @@ static int LoadPartitionContents(const char* filename, FileContents* file) {
 // Save the contents of the given FileContents object under the given
 // filename.  Return 0 on success.
 int SaveFileContents(const char* filename, const FileContents* file) {
-    int fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, S_IRUSR | S_IWUSR);
+    int fd = ota_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, S_IRUSR | S_IWUSR);
     if (fd < 0) {
-        printf("failed to open \"%s\" for write: %s\n",
-               filename, strerror(errno));
+        printf("failed to open \"%s\" for write: %s\n", filename, strerror(errno));
         return -1;
     }
 
-    ssize_t bytes_written = FileSink(file->data, file->size, &fd);
-    if (bytes_written != file->size) {
-        printf("short write of \"%s\" (%ld bytes of %ld) (%s)\n",
-               filename, (long)bytes_written, (long)file->size,
-               strerror(errno));
-        close(fd);
+    ssize_t bytes_written = FileSink(file->data.data(), file->data.size(), &fd);
+    if (bytes_written != static_cast<ssize_t>(file->data.size())) {
+        printf("short write of \"%s\" (%zd bytes of %zu) (%s)\n",
+               filename, bytes_written, file->data.size(), strerror(errno));
+        ota_close(fd);
         return -1;
     }
-    if (fsync(fd) != 0) {
+    if (ota_fsync(fd) != 0) {
         printf("fsync of \"%s\" failed: %s\n", filename, strerror(errno));
         return -1;
     }
-    if (close(fd) != 0) {
+    if (ota_close(fd) != 0) {
         printf("close of \"%s\" failed: %s\n", filename, strerror(errno));
         return -1;
     }
@@ -358,17 +314,22 @@ int SaveFileContents(const char* filename, const FileContents* file) {
 }
 
 // Write a memory buffer to 'target' partition, a string of the form
-// "MTD:<partition>[:...]" or "EMMC:<partition_device>:".  Return 0 on
-// success.
-int WriteToPartition(unsigned char* data, size_t len,
-                        const char* target) {
-    char* copy = strdup(target);
-    const char* magic = strtok(copy, ":");
+// "MTD:<partition>[:...]" or "EMMC:<partition_device>[:...]". The target name
+// might contain multiple colons, but WriteToPartition() only uses the first
+// two and ignores the rest. Return 0 on success.
+int WriteToPartition(const unsigned char* data, size_t len, const char* target) {
+    std::string copy(target);
+    std::vector<std::string> pieces = android::base::Split(copy, ":");
+
+    if (pieces.size() < 2) {
+        printf("WriteToPartition called with bad target (%s)\n", target);
+        return -1;
+    }
 
     enum PartitionType type;
-    if (strcmp(magic, "MTD") == 0) {
+    if (pieces[0] == "MTD") {
         type = MTD;
-    } else if (strcmp(magic, "EMMC") == 0) {
+    } else if (pieces[0] == "EMMC") {
         type = EMMC;
     } else if (strcmp(magic, "BML") == 0) {
         type = EMMC;
@@ -376,7 +337,8 @@ int WriteToPartition(unsigned char* data, size_t len,
         printf("WriteToPartition called with bad target (%s)\n", target);
         return -1;
     }
-    const char* partition = strtok(NULL, ":");
+
+    const char* partition = pieces[1].c_str();
 
     if (strcmp(magic, "BML") == 0) {
         if (strcmp(partition, "boot") == 0) {
@@ -401,30 +363,27 @@ int WriteToPartition(unsigned char* data, size_t len,
     }
 
     switch (type) {
-        case MTD:
+        case MTD: {
             if (!mtd_partitions_scanned) {
                 mtd_scan_partitions();
-                mtd_partitions_scanned = 1;
+                mtd_partitions_scanned = true;
             }
 
             const MtdPartition* mtd = mtd_find_partition_by_name(partition);
             if (mtd == NULL) {
-                printf("mtd partition \"%s\" not found for writing\n",
-                       partition);
+                printf("mtd partition \"%s\" not found for writing\n", partition);
                 return -1;
             }
 
             MtdWriteContext* ctx = mtd_write_partition(mtd);
             if (ctx == NULL) {
-                printf("failed to init mtd partition \"%s\" for writing\n",
-                       partition);
+                printf("failed to init mtd partition \"%s\" for writing\n", partition);
                 return -1;
             }
 
-            size_t written = mtd_write_data(ctx, (char*)data, len);
+            size_t written = mtd_write_data(ctx, reinterpret_cast<const char*>(data), len);
             if (written != len) {
-                printf("only wrote %zu of %zu bytes to MTD %s\n",
-                       written, len, partition);
+                printf("only wrote %zu of %zu bytes to MTD %s\n", written, len, partition);
                 mtd_write_close(ctx);
                 return -1;
             }
@@ -440,62 +399,57 @@ int WriteToPartition(unsigned char* data, size_t len,
                 return -1;
             }
             break;
+        }
 
-        case EMMC:
-        {
+        case EMMC: {
             size_t start = 0;
-            int success = 0;
-            int fd = open(partition, O_RDWR | O_SYNC);
+            bool success = false;
+            int fd = ota_open(partition, O_RDWR | O_SYNC);
             if (fd < 0) {
                 printf("failed to open %s: %s\n", partition, strerror(errno));
                 return -1;
             }
-            int attempt;
 
-            for (attempt = 0; attempt < 2; ++attempt) {
+            for (size_t attempt = 0; attempt < 2; ++attempt) {
                 if (TEMP_FAILURE_RETRY(lseek(fd, start, SEEK_SET)) == -1) {
-                    printf("failed seek on %s: %s\n",
-                           partition, strerror(errno));
+                    printf("failed seek on %s: %s\n", partition, strerror(errno));
                     return -1;
                 }
                 while (start < len) {
                     size_t to_write = len - start;
                     if (to_write > 1<<20) to_write = 1<<20;
 
-                    ssize_t written = TEMP_FAILURE_RETRY(write(fd, data+start, to_write));
+                    ssize_t written = TEMP_FAILURE_RETRY(ota_write(fd, data+start, to_write));
                     if (written == -1) {
                         printf("failed write writing to %s: %s\n", partition, strerror(errno));
                         return -1;
                     }
                     start += written;
                 }
-                if (fsync(fd) != 0) {
-                   printf("failed to sync to %s (%s)\n",
-                          partition, strerror(errno));
+                if (ota_fsync(fd) != 0) {
+                   printf("failed to sync to %s (%s)\n", partition, strerror(errno));
                    return -1;
                 }
-                if (close(fd) != 0) {
-                   printf("failed to close %s (%s)\n",
-                          partition, strerror(errno));
+                if (ota_close(fd) != 0) {
+                   printf("failed to close %s (%s)\n", partition, strerror(errno));
                    return -1;
                 }
-                fd = open(partition, O_RDONLY);
+                fd = ota_open(partition, O_RDONLY);
                 if (fd < 0) {
-                   printf("failed to reopen %s for verify (%s)\n",
-                          partition, strerror(errno));
+                   printf("failed to reopen %s for verify (%s)\n", partition, strerror(errno));
                    return -1;
                 }
 
-                // drop caches so our subsequent verification read
+                // Drop caches so our subsequent verification read
                 // won't just be reading the cache.
                 sync();
-                int dc = open("/proc/sys/vm/drop_caches", O_WRONLY);
-                if (TEMP_FAILURE_RETRY(write(dc, "3\n", 2)) == -1) {
+                int dc = ota_open("/proc/sys/vm/drop_caches", O_WRONLY);
+                if (TEMP_FAILURE_RETRY(ota_write(dc, "3\n", 2)) == -1) {
                     printf("write to /proc/sys/vm/drop_caches failed: %s\n", strerror(errno));
                 } else {
                     printf("  caches dropped\n");
                 }
-                close(dc);
+                ota_close(dc);
                 sleep(1);
 
                 // verify
@@ -506,28 +460,29 @@ int WriteToPartition(unsigned char* data, size_t len,
                 }
                 unsigned char buffer[4096];
                 start = len;
-                size_t p;
-                for (p = 0; p < len; p += sizeof(buffer)) {
+                for (size_t p = 0; p < len; p += sizeof(buffer)) {
                     size_t to_read = len - p;
-                    if (to_read > sizeof(buffer)) to_read = sizeof(buffer);
+                    if (to_read > sizeof(buffer)) {
+                        to_read = sizeof(buffer);
+                    }
 
                     size_t so_far = 0;
                     while (so_far < to_read) {
                         ssize_t read_count =
-                                TEMP_FAILURE_RETRY(read(fd, buffer+so_far, to_read-so_far));
+                                TEMP_FAILURE_RETRY(ota_read(fd, buffer+so_far, to_read-so_far));
                         if (read_count == -1) {
                             printf("verify read error %s at %zu: %s\n",
                                    partition, p, strerror(errno));
                             return -1;
                         }
-                        if ((size_t)read_count < to_read) {
+                        if (static_cast<size_t>(read_count) < to_read) {
                             printf("short verify read %s at %zu: %zd %zu %s\n",
                                    partition, p, read_count, to_read, strerror(errno));
                         }
                         so_far += read_count;
                     }
 
-                    if (memcmp(buffer, data+p, to_read)) {
+                    if (memcmp(buffer, data+p, to_read) != 0) {
                         printf("verification failed starting at %zu\n", p);
                         start = p;
                         break;
@@ -535,7 +490,7 @@ int WriteToPartition(unsigned char* data, size_t len,
                 }
 
                 if (start == len) {
-                    printf("verification read succeeded (attempt %d)\n", attempt+1);
+                    printf("verification read succeeded (attempt %zu)\n", attempt+1);
                     success = true;
                     break;
                 }
@@ -546,7 +501,7 @@ int WriteToPartition(unsigned char* data, size_t len,
                 return -1;
             }
 
-            if (close(fd) != 0) {
+            if (ota_close(fd) != 0) {
                 printf("error closing %s (%s)\n", partition, strerror(errno));
                 return -1;
             }
@@ -555,7 +510,6 @@ int WriteToPartition(unsigned char* data, size_t len,
         }
     }
 
-    free(copy);
     return 0;
 }
 
@@ -565,10 +519,9 @@ int WriteToPartition(unsigned char* data, size_t len,
 // the form "<digest>:<anything>".  Return 0 on success, -1 on any
 // error.
 int ParseSha1(const char* str, uint8_t* digest) {
-    int i;
     const char* ps = str;
     uint8_t* pd = digest;
-    for (i = 0; i < SHA_DIGEST_SIZE * 2; ++i, ++ps) {
+    for (int i = 0; i < SHA_DIGEST_LENGTH * 2; ++i, ++ps) {
         int digit;
         if (*ps >= '0' && *ps <= '9') {
             digit = *ps - '0';
@@ -595,11 +548,10 @@ int ParseSha1(const char* str, uint8_t* digest) {
 // found.
 int FindMatchingPatch(uint8_t* sha1, char* const * const patch_sha1_str,
                       int num_patches) {
-    int i;
-    uint8_t patch_sha1[SHA_DIGEST_SIZE];
-    for (i = 0; i < num_patches; ++i) {
+    uint8_t patch_sha1[SHA_DIGEST_LENGTH];
+    for (int i = 0; i < num_patches; ++i) {
         if (ParseSha1(patch_sha1_str[i], patch_sha1) == 0 &&
-            memcmp(patch_sha1, sha1, SHA_DIGEST_SIZE) == 0) {
+            memcmp(patch_sha1, sha1, SHA_DIGEST_LENGTH) == 0) {
             return i;
         }
     }
@@ -609,10 +561,9 @@ int FindMatchingPatch(uint8_t* sha1, char* const * const patch_sha1_str,
 // Returns 0 if the contents of the file (argv[2]) or the cached file
 // match any of the sha1's on the command line (argv[3:]).  Returns
 // nonzero otherwise.
-int applypatch_check(const char* filename,
-                     int num_patches, char** const patch_sha1_str) {
+int applypatch_check(const char* filename, int num_patches,
+                     char** const patch_sha1_str) {
     FileContents file;
-    file.data = NULL;
 
     // It's okay to specify no sha1s; the check will pass if the
     // LoadFileContents is successful.  (Useful for reading
@@ -624,9 +575,6 @@ int applypatch_check(const char* filename,
         printf("file \"%s\" doesn't have any of expected "
                "sha1 sums; checking cache\n", filename);
 
-        free(file.data);
-        file.data = NULL;
-
         // If the source file is missing or corrupted, it might be because
         // we were killed in the middle of patching it.  A copy of it
         // should have been made in CACHE_TEMP_SOURCE.  If that file
@@ -640,12 +588,9 @@ int applypatch_check(const char* filename,
 
         if (FindMatchingPatch(file.sha1, patch_sha1_str, num_patches) < 0) {
             printf("cache bits don't match any sha1 for \"%s\"\n", filename);
-            free(file.data);
             return 1;
         }
     }
-
-    free(file.data);
     return 0;
 }
 
@@ -655,13 +600,13 @@ int ShowLicenses() {
 }
 
 ssize_t FileSink(const unsigned char* data, ssize_t len, void* token) {
-    int fd = *(int *)token;
+    int fd = *static_cast<int*>(token);
     ssize_t done = 0;
     ssize_t wrote;
-    while (done < (ssize_t) len) {
-        wrote = TEMP_FAILURE_RETRY(write(fd, data+done, len-done));
+    while (done < len) {
+        wrote = TEMP_FAILURE_RETRY(ota_write(fd, data+done, len-done));
         if (wrote == -1) {
-            printf("error writing %d bytes: %s\n", (int)(len-done), strerror(errno));
+            printf("error writing %zd bytes: %s\n", (len-done), strerror(errno));
             return done;
         }
         done += wrote;
@@ -669,19 +614,9 @@ ssize_t FileSink(const unsigned char* data, ssize_t len, void* token) {
     return done;
 }
 
-typedef struct {
-    unsigned char* buffer;
-    ssize_t size;
-    ssize_t pos;
-} MemorySinkInfo;
-
 ssize_t MemorySink(const unsigned char* data, ssize_t len, void* token) {
-    MemorySinkInfo* msi = (MemorySinkInfo*)token;
-    if (msi->size - msi->pos < len) {
-        return -1;
-    }
-    memcpy(msi->buffer + msi->pos, data, len);
-    msi->pos += len;
+    std::string* s = static_cast<std::string*>(token);
+    s->append(reinterpret_cast<const char*>(data), len);
     return len;
 }
 
@@ -705,15 +640,6 @@ int CacheSizeCheck(size_t bytes) {
     }
 }
 
-static void print_short_sha1(const uint8_t sha1[SHA_DIGEST_SIZE]) {
-    int i;
-    const char* hex = "0123456789abcdef";
-    for (i = 0; i < 4; ++i) {
-        putchar(hex[(sha1[i]>>4) & 0xf]);
-        putchar(hex[sha1[i] & 0xf]);
-    }
-}
-
 // This function applies binary patches to files in a way that is safe
 // (the original file is not touched until we have the desired
 // replacement for it) and idempotent (it's okay to run this program
@@ -726,7 +652,7 @@ static void print_short_sha1(const uint8_t sha1[SHA_DIGEST_SIZE]) {
 //   entries in <patch_sha1_str>, the corresponding patch from
 //   <patch_data> (which must be a VAL_BLOB) is applied to produce a
 //   new file (the type of patch is automatically detected from the
-//   blob daat).  If that new file has sha1 hash <target_sha1_str>,
+//   blob data).  If that new file has sha1 hash <target_sha1_str>,
 //   moves it to replace <target_filename>, and exits successfully.
 //   Note that if <source_filename> and <target_filename> are not the
 //   same, <source_filename> is NOT deleted on success.
@@ -737,7 +663,7 @@ static void print_short_sha1(const uint8_t sha1[SHA_DIGEST_SIZE]) {
 //   status.
 //
 // <source_filename> may refer to a partition to read the source data.
-// See the comments for the LoadPartition Contents() function above
+// See the comments for the LoadPartitionContents() function above
 // for the format of such a filename.
 
 int applypatch(const char* source_filename,
@@ -750,12 +676,11 @@ int applypatch(const char* source_filename,
                Value* bonus_data) {
     printf("patch %s: ", source_filename);
 
-    if (target_filename[0] == '-' &&
-        target_filename[1] == '\0') {
+    if (target_filename[0] == '-' && target_filename[1] == '\0') {
         target_filename = source_filename;
     }
 
-    uint8_t target_sha1[SHA_DIGEST_SIZE];
+    uint8_t target_sha1[SHA_DIGEST_LENGTH];
     if (ParseSha1(target_sha1_str, target_sha1) != 0) {
         printf("failed to parse tgt-sha1 \"%s\"\n", target_sha1_str);
         return 1;
@@ -763,45 +688,37 @@ int applypatch(const char* source_filename,
 
     FileContents copy_file;
     FileContents source_file;
-    copy_file.data = NULL;
-    source_file.data = NULL;
     const Value* source_patch_value = NULL;
     const Value* copy_patch_value = NULL;
 
     // We try to load the target file into the source_file object.
     if (LoadFileContents(target_filename, &source_file) == 0) {
-        if (memcmp(source_file.sha1, target_sha1, SHA_DIGEST_SIZE) == 0) {
+        if (memcmp(source_file.sha1, target_sha1, SHA_DIGEST_LENGTH) == 0) {
             // The early-exit case:  the patch was already applied, this file
             // has the desired hash, nothing for us to do.
-            printf("already ");
-            print_short_sha1(target_sha1);
-            putchar('\n');
-            free(source_file.data);
+            printf("already %s\n", short_sha1(target_sha1).c_str());
             return 0;
         }
     }
 
-    if (source_file.data == NULL ||
+    if (source_file.data.empty() ||
         (target_filename != source_filename &&
          strcmp(target_filename, source_filename) != 0)) {
         // Need to load the source file:  either we failed to load the
         // target file, or we did but it's different from the source file.
-        free(source_file.data);
-        source_file.data = NULL;
+        source_file.data.clear();
         LoadFileContents(source_filename, &source_file);
     }
 
-    if (source_file.data != NULL) {
-        int to_use = FindMatchingPatch(source_file.sha1,
-                                       patch_sha1_str, num_patches);
+    if (!source_file.data.empty()) {
+        int to_use = FindMatchingPatch(source_file.sha1, patch_sha1_str, num_patches);
         if (to_use >= 0) {
             source_patch_value = patch_data[to_use];
         }
     }
 
     if (source_patch_value == NULL) {
-        free(source_file.data);
-        source_file.data = NULL;
+        source_file.data.clear();
         printf("source file is bad; trying copy\n");
 
         if (LoadFileContents(CACHE_TEMP_SOURCE, &copy_file) < 0) {
@@ -810,8 +727,7 @@ int applypatch(const char* source_filename,
             return 1;
         }
 
-        int to_use = FindMatchingPatch(copy_file.sha1,
-                                       patch_sha1_str, num_patches);
+        int to_use = FindMatchingPatch(copy_file.sha1, patch_sha1_str, num_patches);
         if (to_use >= 0) {
             copy_patch_value = patch_data[to_use];
         }
@@ -819,19 +735,69 @@ int applypatch(const char* source_filename,
         if (copy_patch_value == NULL) {
             // fail.
             printf("copy file doesn't match source SHA-1s either\n");
-            free(copy_file.data);
             return 1;
         }
     }
 
-    int result = GenerateTarget(&source_file, source_patch_value,
-                                &copy_file, copy_patch_value,
-                                source_filename, target_filename,
-                                target_sha1, target_size, bonus_data);
-    free(source_file.data);
-    free(copy_file.data);
+    return GenerateTarget(&source_file, source_patch_value,
+                          &copy_file, copy_patch_value,
+                          source_filename, target_filename,
+                          target_sha1, target_size, bonus_data);
+}
 
-    return result;
+/*
+ * This function flashes a given image to the target partition. It verifies
+ * the target cheksum first, and will return if target has the desired hash.
+ * It checks the checksum of the given source image before flashing, and
+ * verifies the target partition afterwards. The function is idempotent.
+ * Returns zero on success.
+ */
+int applypatch_flash(const char* source_filename, const char* target_filename,
+                     const char* target_sha1_str, size_t target_size) {
+    printf("flash %s: ", target_filename);
+
+    uint8_t target_sha1[SHA_DIGEST_LENGTH];
+    if (ParseSha1(target_sha1_str, target_sha1) != 0) {
+        printf("failed to parse tgt-sha1 \"%s\"\n", target_sha1_str);
+        return 1;
+    }
+
+    FileContents source_file;
+    std::string target_str(target_filename);
+
+    std::vector<std::string> pieces = android::base::Split(target_str, ":");
+    if (pieces.size() != 2 || (pieces[0] != "MTD" && pieces[0] != "EMMC")) {
+        printf("invalid target name \"%s\"", target_filename);
+        return 1;
+    }
+
+    // Load the target into the source_file object to see if already applied.
+    pieces.push_back(std::to_string(target_size));
+    pieces.push_back(target_sha1_str);
+    std::string fullname = android::base::Join(pieces, ':');
+    if (LoadPartitionContents(fullname.c_str(), &source_file) == 0 &&
+        memcmp(source_file.sha1, target_sha1, SHA_DIGEST_LENGTH) == 0) {
+        // The early-exit case: the image was already applied, this partition
+        // has the desired hash, nothing for us to do.
+        printf("already %s\n", short_sha1(target_sha1).c_str());
+        return 0;
+    }
+
+    if (LoadFileContents(source_filename, &source_file) == 0) {
+        if (memcmp(source_file.sha1, target_sha1, SHA_DIGEST_LENGTH) != 0) {
+            // The source doesn't have desired checksum.
+            printf("source \"%s\" doesn't have expected sha1 sum\n", source_filename);
+            printf("expected: %s, found: %s\n", short_sha1(target_sha1).c_str(),
+                    short_sha1(source_file.sha1).c_str());
+            return 1;
+        }
+    }
+
+    if (WriteToPartition(source_file.data.data(), target_size, target_filename) != 0) {
+        printf("write of copied data to %s failed\n", target_filename);
+        return 1;
+    }
+    return 0;
 }
 
 static int GenerateTarget(FileContents* source_file,
@@ -840,37 +806,58 @@ static int GenerateTarget(FileContents* source_file,
                           const Value* copy_patch_value,
                           const char* source_filename,
                           const char* target_filename,
-                          const uint8_t target_sha1[SHA_DIGEST_SIZE],
+                          const uint8_t target_sha1[SHA_DIGEST_LENGTH],
                           size_t target_size,
                           const Value* bonus_data) {
     int retry = 1;
     SHA_CTX ctx;
-    int output;
-    MemorySinkInfo msi;
+    std::string memory_sink_str;
     FileContents* source_to_use;
-    char* outname;
     int made_copy = 0;
 
+    bool target_is_partition = (strncmp(target_filename, "MTD:", 4) == 0 ||
+                                strncmp(target_filename, "EMMC:", 5) == 0 ||
+                                strncmp(target_filename, "BML:", 4) == 0);
+    const std::string tmp_target_filename = std::string(target_filename) + ".patch";
+
     // assume that target_filename (eg "/system/app/Foo.apk") is located
     // on the same filesystem as its top-level directory ("/system").
     // We need something that exists for calling statfs().
-    char target_fs[strlen(target_filename)+1];
-    char* slash = strchr(target_filename+1, '/');
-    if (slash != NULL) {
-        int count = slash - target_filename;
-        strncpy(target_fs, target_filename, count);
-        target_fs[count] = '\0';
+    std::string target_fs = target_filename;
+    auto slash_pos = target_fs.find('/', 1);
+    if (slash_pos != std::string::npos) {
+        target_fs.resize(slash_pos);
+    }
+
+    const Value* patch;
+    if (source_patch_value != NULL) {
+        source_to_use = source_file;
+        patch = source_patch_value;
     } else {
-        strcpy(target_fs, target_filename);
+        source_to_use = copy_file;
+        patch = copy_patch_value;
+    }
+    if (patch->type != VAL_BLOB) {
+        printf("patch is not a blob\n");
+        return 1;
+    }
+    char* header = patch->data;
+    ssize_t header_bytes_read = patch->size;
+    bool use_bsdiff = false;
+    if (header_bytes_read >= 8 && memcmp(header, "BSDIFF40", 8) == 0) {
+        use_bsdiff = true;
+    } else if (header_bytes_read >= 8 && memcmp(header, "IMGDIFF2", 8) == 0) {
+        use_bsdiff = false;
+    } else {
+        printf("Unknown patch file format\n");
+        return 1;
     }
 
     do {
         // Is there enough room in the target filesystem to hold the patched
         // file?
 
-        if (strncmp(target_filename, "MTD:", 4) == 0 ||
-            strncmp(target_filename, "EMMC:", 5) == 0 ||
-            strncmp(target_filename, "BML:", 4) == 0) {
+        if (target_is_partition) {
             // If the target is a partition, we're actually going to
             // write the output to /tmp and then copy it to the
             // partition.  statfs() always returns 0 blocks free for
@@ -879,7 +866,7 @@ static int GenerateTarget(FileContents* source_file,
 
             // We still write the original source to cache, in case
             // the partition write is interrupted.
-            if (MakeFreeSpaceOnCache(source_file->size) < 0) {
+            if (MakeFreeSpaceOnCache(source_file->data.size()) < 0) {
                 printf("not enough free space on /cache\n");
                 return 1;
             }
@@ -892,13 +879,13 @@ static int GenerateTarget(FileContents* source_file,
         } else {
             int enough_space = 0;
             if (retry > 0) {
-                size_t free_space = FreeSpaceForFile(target_fs);
+                size_t free_space = FreeSpaceForFile(target_fs.c_str());
                 enough_space =
                     (free_space > (256 << 10)) &&          // 256k (two-block) minimum
                     (free_space > (target_size * 3 / 2));  // 50% margin of error
                 if (!enough_space) {
-                    printf("target %ld bytes; free space %ld bytes; retry %d; enough %d\n",
-                           (long)target_size, (long)free_space, retry, enough_space);
+                    printf("target %zu bytes; free space %zu bytes; retry %d; enough %d\n",
+                           target_size, free_space, retry, enough_space);
                 }
             }
 
@@ -917,12 +904,11 @@ static int GenerateTarget(FileContents* source_file,
                     // It's impossible to free space on the target filesystem by
                     // deleting the source if the source is a partition.  If
                     // we're ever in a state where we need to do this, fail.
-                    printf("not enough free space for target but source "
-                           "is partition\n");
+                    printf("not enough free space for target but source is partition\n");
                     return 1;
                 }
 
-                if (MakeFreeSpaceOnCache(source_file->size) < 0) {
+                if (MakeFreeSpaceOnCache(source_file->data.size()) < 0) {
                     printf("not enough free space on /cache\n");
                     return 1;
                 }
@@ -934,87 +920,54 @@ static int GenerateTarget(FileContents* source_file,
                 made_copy = 1;
                 unlink(source_filename);
 
-                size_t free_space = FreeSpaceForFile(target_fs);
-                printf("(now %ld bytes free for target) ", (long)free_space);
+                size_t free_space = FreeSpaceForFile(target_fs.c_str());
+                printf("(now %zu bytes free for target) ", free_space);
             }
         }
 
-        const Value* patch;
-        if (source_patch_value != NULL) {
-            source_to_use = source_file;
-            patch = source_patch_value;
-        } else {
-            source_to_use = copy_file;
-            patch = copy_patch_value;
-        }
-
-        if (patch->type != VAL_BLOB) {
-            printf("patch is not a blob\n");
-            return 1;
-        }
 
         SinkFn sink = NULL;
         void* token = NULL;
-        output = -1;
-        outname = NULL;
-        if (strncmp(target_filename, "MTD:", 4) == 0 ||
-            strncmp(target_filename, "EMMC:", 5) == 0 ||
-            strncmp(target_filename, "BML:", 4) == 0) {
+
+        int output_fd = -1;
+        if (target_is_partition) {
             // We store the decoded output in memory.
-            msi.buffer = malloc(target_size);
-            if (msi.buffer == NULL) {
-                printf("failed to alloc %ld bytes for output\n",
-                       (long)target_size);
-                return 1;
-            }
-            msi.pos = 0;
-            msi.size = target_size;
             sink = MemorySink;
-            token = &msi;
+            token = &memory_sink_str;
         } else {
             // We write the decoded output to "<tgt-file>.patch".
-            outname = (char*)malloc(strlen(target_filename) + 10);
-            strcpy(outname, target_filename);
-            strcat(outname, ".patch");
-
-            output = open(outname, O_WRONLY | O_CREAT | O_TRUNC | O_SYNC,
-                S_IRUSR | S_IWUSR);
-            if (output < 0) {
-                printf("failed to open output file %s: %s\n",
-                       outname, strerror(errno));
+            output_fd = ota_open(tmp_target_filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC | O_SYNC,
+                          S_IRUSR | S_IWUSR);
+            if (output_fd < 0) {
+                printf("failed to open output file %s: %s\n", tmp_target_filename.c_str(),
+                       strerror(errno));
                 return 1;
             }
             sink = FileSink;
-            token = &output;
+            token = &output_fd;
         }
 
-        char* header = patch->data;
-        ssize_t header_bytes_read = patch->size;
 
-        SHA_init(&ctx);
+        SHA1_Init(&ctx);
 
         int result;
-
-        if (header_bytes_read >= 8 &&
-            memcmp(header, "BSDIFF40", 8) == 0) {
-            result = ApplyBSDiffPatch(source_to_use->data, source_to_use->size,
+        if (use_bsdiff) {
+            result = ApplyBSDiffPatch(source_to_use->data.data(), source_to_use->data.size(),
                                       patch, 0, sink, token, &ctx);
-        } else if (header_bytes_read >= 8 &&
-                   memcmp(header, "IMGDIFF2", 8) == 0) {
-            result = ApplyImagePatch(source_to_use->data, source_to_use->size,
-                                     patch, sink, token, &ctx, bonus_data);
         } else {
-            printf("Unknown patch file format\n");
-            return 1;
+            result = ApplyImagePatch(source_to_use->data.data(), source_to_use->data.size(),
+                                     patch, sink, token, &ctx, bonus_data);
         }
 
-        if (output >= 0) {
-            if (fsync(output) != 0) {
-                printf("failed to fsync file \"%s\" (%s)\n", outname, strerror(errno));
+        if (!target_is_partition) {
+            if (ota_fsync(output_fd) != 0) {
+                printf("failed to fsync file \"%s\" (%s)\n", tmp_target_filename.c_str(),
+                       strerror(errno));
                 result = 1;
             }
-            if (close(output) != 0) {
-                printf("failed to close file \"%s\" (%s)\n", outname, strerror(errno));
+            if (ota_close(output_fd) != 0) {
+                printf("failed to close file \"%s\" (%s)\n", tmp_target_filename.c_str(),
+                       strerror(errno));
                 result = 1;
             }
         }
@@ -1026,8 +979,8 @@ static int GenerateTarget(FileContents* source_file,
             } else {
                 printf("applying patch failed; retrying\n");
             }
-            if (outname != NULL) {
-                unlink(outname);
+            if (!target_is_partition) {
+                unlink(tmp_target_filename.c_str());
             }
         } else {
             // succeeded; no need to retry
@@ -1035,47 +988,46 @@ static int GenerateTarget(FileContents* source_file,
         }
     } while (retry-- > 0);
 
-    const uint8_t* current_target_sha1 = SHA_final(&ctx);
-    if (memcmp(current_target_sha1, target_sha1, SHA_DIGEST_SIZE) != 0) {
+    uint8_t current_target_sha1[SHA_DIGEST_LENGTH];
+    SHA1_Final(current_target_sha1, &ctx);
+    if (memcmp(current_target_sha1, target_sha1, SHA_DIGEST_LENGTH) != 0) {
         printf("patch did not produce expected sha1\n");
         return 1;
     } else {
-        printf("now ");
-        print_short_sha1(target_sha1);
-        putchar('\n');
+        printf("now %s\n", short_sha1(target_sha1).c_str());
     }
 
-    if (output < 0) {
+    if (target_is_partition) {
         // Copy the temp file to the partition.
-        if (WriteToPartition(msi.buffer, msi.pos, target_filename) != 0) {
+        if (WriteToPartition(reinterpret_cast<const unsigned char*>(memory_sink_str.c_str()),
+                             memory_sink_str.size(), target_filename) != 0) {
             printf("write of patched data to %s failed\n", target_filename);
             return 1;
         }
-        free(msi.buffer);
     } else {
         // Give the .patch file the same owner, group, and mode of the
         // original source file.
-        if (chmod(outname, source_to_use->st.st_mode) != 0) {
-            printf("chmod of \"%s\" failed: %s\n", outname, strerror(errno));
+        if (chmod(tmp_target_filename.c_str(), source_to_use->st.st_mode) != 0) {
+            printf("chmod of \"%s\" failed: %s\n", tmp_target_filename.c_str(), strerror(errno));
             return 1;
         }
-        if (chown(outname, source_to_use->st.st_uid,
-                  source_to_use->st.st_gid) != 0) {
-            printf("chown of \"%s\" failed: %s\n", outname, strerror(errno));
+        if (chown(tmp_target_filename.c_str(), source_to_use->st.st_uid, source_to_use->st.st_gid) != 0) {
+            printf("chown of \"%s\" failed: %s\n", tmp_target_filename.c_str(), strerror(errno));
             return 1;
         }
 
         // Finally, rename the .patch file to replace the target file.
-        if (rename(outname, target_filename) != 0) {
-            printf("rename of .patch to \"%s\" failed: %s\n",
-                   target_filename, strerror(errno));
+        if (rename(tmp_target_filename.c_str(), target_filename) != 0) {
+            printf("rename of .patch to \"%s\" failed: %s\n", target_filename, strerror(errno));
             return 1;
         }
     }
 
     // If this run of applypatch created the copy, and we're here, we
     // can delete it.
-    if (made_copy) unlink(CACHE_TEMP_SOURCE);
+    if (made_copy) {
+        unlink(CACHE_TEMP_SOURCE);
+    }
 
     // Success!
     return 0;
diff --git a/applypatch/applypatch.h b/applypatch/applypatch.h
index edec84812..f392c5534 100644
--- a/applypatch/applypatch.h
+++ b/applypatch/applypatch.h
@@ -18,20 +18,17 @@
 #define _APPLYPATCH_H
 
 #include <sys/stat.h>
-#include "mincrypt/sha.h"
-#include "edify/expr.h"
 
-typedef struct _Patch {
-  uint8_t sha1[SHA_DIGEST_SIZE];
-  const char* patch_filename;
-} Patch;
+#include <vector>
+
+#include "openssl/sha.h"
+#include "edify/expr.h"
 
-typedef struct _FileContents {
-  uint8_t sha1[SHA_DIGEST_SIZE];
-  unsigned char* data;
-  ssize_t size;
+struct FileContents {
+  uint8_t sha1[SHA_DIGEST_LENGTH];
+  std::vector<unsigned char> data;
   struct stat st;
-} FileContents;
+};
 
 // When there isn't enough room on the target filesystem to hold the
 // patched version of the file, we copy the original here and delete
@@ -48,6 +45,8 @@ size_t FreeSpaceForFile(const char* filename);
 int CacheSizeCheck(size_t bytes);
 int ParseSha1(const char* str, uint8_t* digest);
 
+int applypatch_flash(const char* source_filename, const char* target_filename,
+                     const char* target_sha1_str, size_t target_size);
 int applypatch(const char* source_filename,
                const char* target_filename,
                const char* target_sha1_str,
@@ -66,22 +65,22 @@ void FreeFileContents(FileContents* file);
 int FindMatchingPatch(uint8_t* sha1, char* const * const patch_sha1_str,
                       int num_patches);
 
-// bsdiff.c
+// bsdiff.cpp
 void ShowBSDiffLicense();
 int ApplyBSDiffPatch(const unsigned char* old_data, ssize_t old_size,
                      const Value* patch, ssize_t patch_offset,
                      SinkFn sink, void* token, SHA_CTX* ctx);
 int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
                         const Value* patch, ssize_t patch_offset,
-                        unsigned char** new_data, ssize_t* new_size);
+                        std::vector<unsigned char>* new_data);
 
-// imgpatch.c
+// imgpatch.cpp
 int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size,
                     const Value* patch,
                     SinkFn sink, void* token, SHA_CTX* ctx,
                     const Value* bonus_data);
 
-// freecache.c
+// freecache.cpp
 int MakeFreeSpaceOnCache(size_t bytes_needed);
 
 #endif
diff --git a/applypatch/bsdiff.c b/applypatch/bsdiff.cpp
index b6d342b7a..55dbe5cf1 100644
--- a/applypatch/bsdiff.c
+++ b/applypatch/bsdiff.cpp
@@ -156,24 +156,24 @@ static void qsufsort(off_t *I,off_t *V,u_char *old,off_t oldsize)
 	for(i=0;i<oldsize+1;i++) I[V[i]]=i;
 }
 
-static off_t matchlen(u_char *old,off_t oldsize,u_char *new,off_t newsize)
+static off_t matchlen(u_char *olddata,off_t oldsize,u_char *newdata,off_t newsize)
 {
 	off_t i;
 
 	for(i=0;(i<oldsize)&&(i<newsize);i++)
-		if(old[i]!=new[i]) break;
+		if(olddata[i]!=newdata[i]) break;
 
 	return i;
 }
 
 static off_t search(off_t *I,u_char *old,off_t oldsize,
-		u_char *new,off_t newsize,off_t st,off_t en,off_t *pos)
+		u_char *newdata,off_t newsize,off_t st,off_t en,off_t *pos)
 {
 	off_t x,y;
 
 	if(en-st<2) {
-		x=matchlen(old+I[st],oldsize-I[st],new,newsize);
-		y=matchlen(old+I[en],oldsize-I[en],new,newsize);
+		x=matchlen(old+I[st],oldsize-I[st],newdata,newsize);
+		y=matchlen(old+I[en],oldsize-I[en],newdata,newsize);
 
 		if(x>y) {
 			*pos=I[st];
@@ -185,10 +185,10 @@ static off_t search(off_t *I,u_char *old,off_t oldsize,
 	};
 
 	x=st+(en-st)/2;
-	if(memcmp(old+I[x],new,MIN(oldsize-I[x],newsize))<0) {
-		return search(I,old,oldsize,new,newsize,x,en,pos);
+	if(memcmp(old+I[x],newdata,MIN(oldsize-I[x],newsize))<0) {
+		return search(I,old,oldsize,newdata,newsize,x,en,pos);
 	} else {
-		return search(I,old,oldsize,new,newsize,st,x,pos);
+		return search(I,old,oldsize,newdata,newsize,st,x,pos);
 	};
 }
 
@@ -212,8 +212,8 @@ static void offtout(off_t x,u_char *buf)
 
 // This is main() from bsdiff.c, with the following changes:
 //
-//    - old, oldsize, new, newsize are arguments; we don't load this
-//      data from files.  old and new are owned by the caller; we
+//    - old, oldsize, newdata, newsize are arguments; we don't load this
+//      data from files.  old and newdata are owned by the caller; we
 //      don't free them at the end.
 //
 //    - the "I" block of memory is owned by the caller, who passes a
@@ -221,7 +221,7 @@ static void offtout(off_t x,u_char *buf)
 //      bsdiff() multiple times with the same 'old' data, we only do
 //      the qsufsort() step the first time.
 //
-int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
+int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* newdata, off_t newsize,
            const char* patch_filename)
 {
 	int fd;
@@ -242,15 +242,15 @@ int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
 
         if (*IP == NULL) {
             off_t* V;
-            *IP = malloc((oldsize+1) * sizeof(off_t));
-            V = malloc((oldsize+1) * sizeof(off_t));
+            *IP = reinterpret_cast<off_t*>(malloc((oldsize+1) * sizeof(off_t)));
+            V = reinterpret_cast<off_t*>(malloc((oldsize+1) * sizeof(off_t)));
             qsufsort(*IP, V, old, oldsize);
             free(V);
         }
         I = *IP;
 
-	if(((db=malloc(newsize+1))==NULL) ||
-		((eb=malloc(newsize+1))==NULL)) err(1,NULL);
+	if(((db=reinterpret_cast<u_char*>(malloc(newsize+1)))==NULL) ||
+		((eb=reinterpret_cast<u_char*>(malloc(newsize+1)))==NULL)) err(1,NULL);
 	dblen=0;
 	eblen=0;
 
@@ -284,26 +284,26 @@ int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
 		oldscore=0;
 
 		for(scsc=scan+=len;scan<newsize;scan++) {
-			len=search(I,old,oldsize,new+scan,newsize-scan,
+			len=search(I,old,oldsize,newdata+scan,newsize-scan,
 					0,oldsize,&pos);
 
 			for(;scsc<scan+len;scsc++)
 			if((scsc+lastoffset<oldsize) &&
-				(old[scsc+lastoffset] == new[scsc]))
+				(old[scsc+lastoffset] == newdata[scsc]))
 				oldscore++;
 
 			if(((len==oldscore) && (len!=0)) ||
 				(len>oldscore+8)) break;
 
 			if((scan+lastoffset<oldsize) &&
-				(old[scan+lastoffset] == new[scan]))
+				(old[scan+lastoffset] == newdata[scan]))
 				oldscore--;
 		};
 
 		if((len!=oldscore) || (scan==newsize)) {
 			s=0;Sf=0;lenf=0;
 			for(i=0;(lastscan+i<scan)&&(lastpos+i<oldsize);) {
-				if(old[lastpos+i]==new[lastscan+i]) s++;
+				if(old[lastpos+i]==newdata[lastscan+i]) s++;
 				i++;
 				if(s*2-i>Sf*2-lenf) { Sf=s; lenf=i; };
 			};
@@ -312,7 +312,7 @@ int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
 			if(scan<newsize) {
 				s=0;Sb=0;
 				for(i=1;(scan>=lastscan+i)&&(pos>=i);i++) {
-					if(old[pos-i]==new[scan-i]) s++;
+					if(old[pos-i]==newdata[scan-i]) s++;
 					if(s*2-i>Sb*2-lenb) { Sb=s; lenb=i; };
 				};
 			};
@@ -321,9 +321,9 @@ int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
 				overlap=(lastscan+lenf)-(scan-lenb);
 				s=0;Ss=0;lens=0;
 				for(i=0;i<overlap;i++) {
-					if(new[lastscan+lenf-overlap+i]==
+					if(newdata[lastscan+lenf-overlap+i]==
 					   old[lastpos+lenf-overlap+i]) s++;
-					if(new[scan-lenb+i]==
+					if(newdata[scan-lenb+i]==
 					   old[pos-lenb+i]) s--;
 					if(s>Ss) { Ss=s; lens=i+1; };
 				};
@@ -333,9 +333,9 @@ int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
 			};
 
 			for(i=0;i<lenf;i++)
-				db[dblen+i]=new[lastscan+i]-old[lastpos+i];
+				db[dblen+i]=newdata[lastscan+i]-old[lastpos+i];
 			for(i=0;i<(scan-lenb)-(lastscan+lenf);i++)
-				eb[eblen+i]=new[lastscan+lenf+i];
+				eb[eblen+i]=newdata[lastscan+lenf+i];
 
 			dblen+=lenf;
 			eblen+=(scan-lenb)-(lastscan+lenf);
diff --git a/applypatch/bspatch.c b/applypatch/bspatch.cpp
index b57760eda..ebb55f1d1 100644
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.cpp
@@ -22,14 +22,14 @@
 
 #include <stdio.h>
 #include <sys/stat.h>
+#include <sys/types.h>
 #include <errno.h>
-#include <malloc.h>
 #include <unistd.h>
 #include <string.h>
 
 #include <bzlib.h>
 
-#include "mincrypt/sha.h"
+#include "openssl/sha.h"
 #include "applypatch.h"
 
 void ShowBSDiffLicense() {
@@ -102,26 +102,22 @@ int ApplyBSDiffPatch(const unsigned char* old_data, ssize_t old_size,
                      const Value* patch, ssize_t patch_offset,
                      SinkFn sink, void* token, SHA_CTX* ctx) {
 
-    unsigned char* new_data;
-    ssize_t new_size;
-    if (ApplyBSDiffPatchMem(old_data, old_size, patch, patch_offset,
-                            &new_data, &new_size) != 0) {
+    std::vector<unsigned char> new_data;
+    if (ApplyBSDiffPatchMem(old_data, old_size, patch, patch_offset, &new_data) != 0) {
         return -1;
     }
 
-    if (sink(new_data, new_size, token) < new_size) {
+    if (sink(new_data.data(), new_data.size(), token) < static_cast<ssize_t>(new_data.size())) {
         printf("short write of output: %d (%s)\n", errno, strerror(errno));
         return 1;
     }
-    if (ctx) SHA_update(ctx, new_data, new_size);
-    free(new_data);
-
+    if (ctx) SHA1_Update(ctx, new_data.data(), new_data.size());
     return 0;
 }
 
 int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
                         const Value* patch, ssize_t patch_offset,
-                        unsigned char** new_data, ssize_t* new_size) {
+                        std::vector<unsigned char>* new_data) {
     // Patch data format:
     //   0       8       "BSDIFF40"
     //   8       8       X
@@ -140,12 +136,12 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
         return 1;
     }
 
-    ssize_t ctrl_len, data_len;
+    ssize_t ctrl_len, data_len, new_size;
     ctrl_len = offtin(header+8);
     data_len = offtin(header+16);
-    *new_size = offtin(header+24);
+    new_size = offtin(header+24);
 
-    if (ctrl_len < 0 || data_len < 0 || *new_size < 0) {
+    if (ctrl_len < 0 || data_len < 0 || new_size < 0) {
         printf("corrupt patch file header (data lengths)\n");
         return 1;
     }
@@ -182,19 +178,14 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
         printf("failed to bzinit extra stream (%d)\n", bzerr);
     }
 
-    *new_data = malloc(*new_size);
-    if (*new_data == NULL) {
-        printf("failed to allocate %ld bytes of memory for output file\n",
-               (long)*new_size);
-        return 1;
-    }
+    new_data->resize(new_size);
 
     off_t oldpos = 0, newpos = 0;
     off_t ctrl[3];
     off_t len_read;
     int i;
     unsigned char buf[24];
-    while (newpos < *new_size) {
+    while (newpos < new_size) {
         // Read control data
         if (FillBuffer(buf, 24, &cstream) != 0) {
             printf("error while reading control stream\n");
@@ -210,13 +201,13 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
         }
 
         // Sanity check
-        if (newpos + ctrl[0] > *new_size) {
+        if (newpos + ctrl[0] > new_size) {
             printf("corrupt patch (new file overrun)\n");
             return 1;
         }
 
         // Read diff string
-        if (FillBuffer(*new_data + newpos, ctrl[0], &dstream) != 0) {
+        if (FillBuffer(new_data->data() + newpos, ctrl[0], &dstream) != 0) {
             printf("error while reading diff stream\n");
             return 1;
         }
@@ -233,13 +224,13 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
         oldpos += ctrl[0];
 
         // Sanity check
-        if (newpos + ctrl[1] > *new_size) {
+        if (newpos + ctrl[1] > new_size) {
             printf("corrupt patch (new file overrun)\n");
             return 1;
         }
 
         // Read extra string
-        if (FillBuffer(*new_data + newpos, ctrl[1], &estream) != 0) {
+        if (FillBuffer(new_data->data() + newpos, ctrl[1], &estream) != 0) {
             printf("error while reading extra stream\n");
             return 1;
         }
diff --git a/applypatch/freecache.c b/applypatch/freecache.c
deleted file mode 100644
index 9827fda06..000000000
--- a/applypatch/freecache.c
+++ /dev/null
@@ -1,172 +0,0 @@
-#include <errno.h>
-#include <libgen.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/statfs.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <ctype.h>
-
-#include "applypatch.h"
-
-static int EliminateOpenFiles(char** files, int file_count) {
-  DIR* d;
-  struct dirent* de;
-  d = opendir("/proc");
-  if (d == NULL) {
-    printf("error opening /proc: %s\n", strerror(errno));
-    return -1;
-  }
-  while ((de = readdir(d)) != 0) {
-    int i;
-    for (i = 0; de->d_name[i] != '\0' && isdigit(de->d_name[i]); ++i);
-    if (de->d_name[i]) continue;
-
-    // de->d_name[i] is numeric
-
-    char path[FILENAME_MAX];
-    strcpy(path, "/proc/");
-    strcat(path, de->d_name);
-    strcat(path, "/fd/");
-
-    DIR* fdd;
-    struct dirent* fdde;
-    fdd = opendir(path);
-    if (fdd == NULL) {
-      printf("error opening %s: %s\n", path, strerror(errno));
-      continue;
-    }
-    while ((fdde = readdir(fdd)) != 0) {
-      char fd_path[FILENAME_MAX];
-      char link[FILENAME_MAX];
-      strcpy(fd_path, path);
-      strcat(fd_path, fdde->d_name);
-
-      int count;
-      count = readlink(fd_path, link, sizeof(link)-1);
-      if (count >= 0) {
-        link[count] = '\0';
-
-        // This is inefficient, but it should only matter if there are
-        // lots of files in /cache, and lots of them are open (neither
-        // of which should be true, especially in recovery).
-        if (strncmp(link, "/cache/", 7) == 0) {
-          int j;
-          for (j = 0; j < file_count; ++j) {
-            if (files[j] && strcmp(files[j], link) == 0) {
-              printf("%s is open by %s\n", link, de->d_name);
-              free(files[j]);
-              files[j] = NULL;
-            }
-          }
-        }
-      }
-    }
-    closedir(fdd);
-  }
-  closedir(d);
-
-  return 0;
-}
-
-int FindExpendableFiles(char*** names, int* entries) {
-  DIR* d;
-  struct dirent* de;
-  int size = 32;
-  *entries = 0;
-  *names = malloc(size * sizeof(char*));
-
-  char path[FILENAME_MAX];
-
-  // We're allowed to delete unopened regular files in any of these
-  // directories.
-  const char* dirs[2] = {"/cache", "/cache/recovery/otatest"};
-
-  unsigned int i;
-  for (i = 0; i < sizeof(dirs)/sizeof(dirs[0]); ++i) {
-    d = opendir(dirs[i]);
-    if (d == NULL) {
-      printf("error opening %s: %s\n", dirs[i], strerror(errno));
-      continue;
-    }
-
-    // Look for regular files in the directory (not in any subdirectories).
-    while ((de = readdir(d)) != 0) {
-      strcpy(path, dirs[i]);
-      strcat(path, "/");
-      strcat(path, de->d_name);
-
-      // We can't delete CACHE_TEMP_SOURCE; if it's there we might have
-      // restarted during installation and could be depending on it to
-      // be there.
-      if (strcmp(path, CACHE_TEMP_SOURCE) == 0) continue;
-
-      struct stat st;
-      if (stat(path, &st) == 0 && S_ISREG(st.st_mode)) {
-        if (*entries >= size) {
-          size *= 2;
-          *names = realloc(*names, size * sizeof(char*));
-        }
-        (*names)[(*entries)++] = strdup(path);
-      }
-    }
-
-    closedir(d);
-  }
-
-  printf("%d regular files in deletable directories\n", *entries);
-
-  if (EliminateOpenFiles(*names, *entries) < 0) {
-    return -1;
-  }
-
-  return 0;
-}
-
-int MakeFreeSpaceOnCache(size_t bytes_needed) {
-  size_t free_now = FreeSpaceForFile("/cache");
-  printf("%ld bytes free on /cache (%ld needed)\n",
-         (long)free_now, (long)bytes_needed);
-
-  if (free_now >= bytes_needed) {
-    return 0;
-  }
-
-  char** names;
-  int entries;
-
-  if (FindExpendableFiles(&names, &entries) < 0) {
-    return -1;
-  }
-
-  if (entries == 0) {
-    // nothing we can delete to free up space!
-    printf("no files can be deleted to free space on /cache\n");
-    return -1;
-  }
-
-  // We could try to be smarter about which files to delete:  the
-  // biggest ones?  the smallest ones that will free up enough space?
-  // the oldest?  the newest?
-  //
-  // Instead, we'll be dumb.
-
-  int i;
-  for (i = 0; i < entries && free_now < bytes_needed; ++i) {
-    if (names[i]) {
-      unlink(names[i]);
-      free_now = FreeSpaceForFile("/cache");
-      printf("deleted %s; now %ld bytes free\n", names[i], (long)free_now);
-      free(names[i]);
-    }
-  }
-
-  for (; i < entries; ++i) {
-    free(names[i]);
-  }
-  free(names);
-
-  return (free_now >= bytes_needed) ? 0 : -1;
-}
diff --git a/applypatch/freecache.cpp b/applypatch/freecache.cpp
new file mode 100644
index 000000000..c84f42797
--- /dev/null
+++ b/applypatch/freecache.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <errno.h>
+#include <libgen.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/statfs.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <ctype.h>
+
+#include <memory>
+#include <set>
+#include <string>
+
+#include <android-base/parseint.h>
+#include <android-base/stringprintf.h>
+
+#include "applypatch.h"
+
+static int EliminateOpenFiles(std::set<std::string>* files) {
+  std::unique_ptr<DIR, decltype(&closedir)> d(opendir("/proc"), closedir);
+  if (!d) {
+    printf("error opening /proc: %s\n", strerror(errno));
+    return -1;
+  }
+  struct dirent* de;
+  while ((de = readdir(d.get())) != 0) {
+    unsigned int pid;
+    if (!android::base::ParseUint(de->d_name, &pid)) {
+        continue;
+    }
+    std::string path = android::base::StringPrintf("/proc/%s/fd/", de->d_name);
+
+    struct dirent* fdde;
+    std::unique_ptr<DIR, decltype(&closedir)> fdd(opendir(path.c_str()), closedir);
+    if (!fdd) {
+      printf("error opening %s: %s\n", path.c_str(), strerror(errno));
+      continue;
+    }
+    while ((fdde = readdir(fdd.get())) != 0) {
+      std::string fd_path = path + fdde->d_name;
+      char link[FILENAME_MAX];
+
+      int count = readlink(fd_path.c_str(), link, sizeof(link)-1);
+      if (count >= 0) {
+        link[count] = '\0';
+        if (strncmp(link, "/cache/", 7) == 0) {
+          if (files->erase(link) > 0) {
+            printf("%s is open by %s\n", link, de->d_name);
+          }
+        }
+      }
+    }
+  }
+  return 0;
+}
+
+static std::set<std::string> FindExpendableFiles() {
+  std::set<std::string> files;
+  // We're allowed to delete unopened regular files in any of these
+  // directories.
+  const char* dirs[2] = {"/cache", "/cache/recovery/otatest"};
+
+  for (size_t i = 0; i < sizeof(dirs)/sizeof(dirs[0]); ++i) {
+    std::unique_ptr<DIR, decltype(&closedir)> d(opendir(dirs[i]), closedir);
+    if (!d) {
+      printf("error opening %s: %s\n", dirs[i], strerror(errno));
+      continue;
+    }
+
+    // Look for regular files in the directory (not in any subdirectories).
+    struct dirent* de;
+    while ((de = readdir(d.get())) != 0) {
+      std::string path = std::string(dirs[i]) + "/" + de->d_name;
+
+      // We can't delete CACHE_TEMP_SOURCE; if it's there we might have
+      // restarted during installation and could be depending on it to
+      // be there.
+      if (path == CACHE_TEMP_SOURCE) {
+        continue;
+      }
+
+      struct stat st;
+      if (stat(path.c_str(), &st) == 0 && S_ISREG(st.st_mode)) {
+        files.insert(path);
+      }
+    }
+  }
+
+  printf("%zu regular files in deletable directories\n", files.size());
+  if (EliminateOpenFiles(&files) < 0) {
+    return std::set<std::string>();
+  }
+  return files;
+}
+
+int MakeFreeSpaceOnCache(size_t bytes_needed) {
+  size_t free_now = FreeSpaceForFile("/cache");
+  printf("%zu bytes free on /cache (%zu needed)\n", free_now, bytes_needed);
+
+  if (free_now >= bytes_needed) {
+    return 0;
+  }
+  std::set<std::string> files = FindExpendableFiles();
+  if (files.empty()) {
+    // nothing we can delete to free up space!
+    printf("no files can be deleted to free space on /cache\n");
+    return -1;
+  }
+
+  // We could try to be smarter about which files to delete:  the
+  // biggest ones?  the smallest ones that will free up enough space?
+  // the oldest?  the newest?
+  //
+  // Instead, we'll be dumb.
+
+  for (const auto& file : files) {
+    unlink(file.c_str());
+    free_now = FreeSpaceForFile("/cache");
+    printf("deleted %s; now %zu bytes free\n", file.c_str(), free_now);
+    if (free_now < bytes_needed) {
+        break;
+    }
+  }
+  return (free_now >= bytes_needed) ? 0 : -1;
+}
diff --git a/applypatch/imgdiff.c b/applypatch/imgdiff.cpp
index 3bac8be91..f22502e38 100644
--- a/applypatch/imgdiff.c
+++ b/applypatch/imgdiff.cpp
@@ -122,6 +122,7 @@
  */
 
 #include <errno.h>
+#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -179,7 +180,7 @@ static int fileentry_compare(const void* a, const void* b) {
 }
 
 // from bsdiff.c
-int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* new, off_t newsize,
+int bsdiff(u_char* old, off_t oldsize, off_t** IP, u_char* newdata, off_t newsize,
            const char* patch_filename);
 
 unsigned char* ReadZip(const char* filename,
@@ -191,9 +192,10 @@ unsigned char* ReadZip(const char* filename,
     return NULL;
   }
 
-  unsigned char* img = malloc(st.st_size);
+  size_t sz = static_cast<size_t>(st.st_size);
+  unsigned char* img = reinterpret_cast<unsigned char*>(malloc(sz));
   FILE* f = fopen(filename, "rb");
-  if (fread(img, 1, st.st_size, f) != st.st_size) {
+  if (fread(img, 1, sz, f) != sz) {
     printf("failed to read \"%s\" %s\n", filename, strerror(errno));
     fclose(f);
     return NULL;
@@ -218,7 +220,8 @@ unsigned char* ReadZip(const char* filename,
   int cdcount = Read2(img+i+8);
   int cdoffset = Read4(img+i+16);
 
-  ZipFileEntry* temp_entries = malloc(cdcount * sizeof(ZipFileEntry));
+  ZipFileEntry* temp_entries = reinterpret_cast<ZipFileEntry*>(malloc(
+      cdcount * sizeof(ZipFileEntry)));
   int entrycount = 0;
 
   unsigned char* cd = img+cdoffset;
@@ -235,7 +238,7 @@ unsigned char* ReadZip(const char* filename,
     int mlen = Read2(cd+32);   // file comment len
     int hoffset = Read4(cd+42);   // local header offset
 
-    char* filename = malloc(nlen+1);
+    char* filename = reinterpret_cast<char*>(malloc(nlen+1));
     memcpy(filename, cd+46, nlen);
     filename[nlen] = '\0';
 
@@ -284,7 +287,7 @@ unsigned char* ReadZip(const char* filename,
 #endif
 
   *num_chunks = 0;
-  *chunks = malloc((entrycount*2+2) * sizeof(ImageChunk));
+  *chunks = reinterpret_cast<ImageChunk*>(malloc((entrycount*2+2) * sizeof(ImageChunk)));
   ImageChunk* curr = *chunks;
 
   if (include_pseudo_chunk) {
@@ -311,7 +314,7 @@ unsigned char* ReadZip(const char* filename,
       curr->I = NULL;
 
       curr->len = temp_entries[nextentry].uncomp_len;
-      curr->data = malloc(curr->len);
+      curr->data = reinterpret_cast<unsigned char*>(malloc(curr->len));
 
       z_stream strm;
       strm.zalloc = Z_NULL;
@@ -381,9 +384,10 @@ unsigned char* ReadImage(const char* filename,
     return NULL;
   }
 
-  unsigned char* img = malloc(st.st_size + 4);
+  size_t sz = static_cast<size_t>(st.st_size);
+  unsigned char* img = reinterpret_cast<unsigned char*>(malloc(sz + 4));
   FILE* f = fopen(filename, "rb");
-  if (fread(img, 1, st.st_size, f) != st.st_size) {
+  if (fread(img, 1, sz, f) != sz) {
     printf("failed to read \"%s\" %s\n", filename, strerror(errno));
     fclose(f);
     return NULL;
@@ -393,17 +397,18 @@ unsigned char* ReadImage(const char* filename,
   // append 4 zero bytes to the data so we can always search for the
   // four-byte string 1f8b0800 starting at any point in the actual
   // file data, without special-casing the end of the data.
-  memset(img+st.st_size, 0, 4);
+  memset(img+sz, 0, 4);
 
   size_t pos = 0;
 
   *num_chunks = 0;
   *chunks = NULL;
 
-  while (pos < st.st_size) {
+  while (pos < sz) {
     unsigned char* p = img+pos;
 
-    if (st.st_size - pos >= 4 &&
+    bool processed_deflate = false;
+    if (sz - pos >= 4 &&
         p[0] == 0x1f && p[1] == 0x8b &&
         p[2] == 0x08 &&    // deflate compression
         p[3] == 0x00) {    // no header flags
@@ -411,7 +416,8 @@ unsigned char* ReadImage(const char* filename,
       size_t chunk_offset = pos;
 
       *num_chunks += 3;
-      *chunks = realloc(*chunks, *num_chunks * sizeof(ImageChunk));
+      *chunks = reinterpret_cast<ImageChunk*>(realloc(*chunks,
+          *num_chunks * sizeof(ImageChunk)));
       ImageChunk* curr = *chunks + (*num_chunks-3);
 
       // create a normal chunk for the header.
@@ -435,7 +441,7 @@ unsigned char* ReadImage(const char* filename,
 
       size_t allocated = 32768;
       curr->len = 0;
-      curr->data = malloc(allocated);
+      curr->data = reinterpret_cast<unsigned char*>(malloc(allocated));
       curr->start = pos;
       curr->deflate_data = p;
 
@@ -443,7 +449,7 @@ unsigned char* ReadImage(const char* filename,
       strm.zalloc = Z_NULL;
       strm.zfree = Z_NULL;
       strm.opaque = Z_NULL;
-      strm.avail_in = st.st_size - pos;
+      strm.avail_in = sz - pos;
       strm.next_in = p;
 
       // -15 means we are decoding a 'raw' deflate stream; zlib will
@@ -455,21 +461,27 @@ unsigned char* ReadImage(const char* filename,
         strm.next_out = curr->data + curr->len;
         ret = inflate(&strm, Z_NO_FLUSH);
         if (ret < 0) {
-            printf("Error: inflate failed [%s] at file offset [%zu]\n"
-                    "imgdiff only supports gzip kernel compression,"
-                    " did you try CONFIG_KERNEL_LZO?\n",
-                    strm.msg, chunk_offset);
-            free(img);
-            return NULL;
+          if (!processed_deflate) {
+            // This is the first chunk, assume that it's just a spurious
+            // gzip header instead of a real one.
+            break;
+          }
+          printf("Error: inflate failed [%s] at file offset [%zu]\n"
+                 "imgdiff only supports gzip kernel compression,"
+                 " did you try CONFIG_KERNEL_LZO?\n",
+                 strm.msg, chunk_offset);
+          free(img);
+          return NULL;
         }
         curr->len = allocated - strm.avail_out;
         if (strm.avail_out == 0) {
           allocated *= 2;
-          curr->data = realloc(curr->data, allocated);
+          curr->data = reinterpret_cast<unsigned char*>(realloc(curr->data, allocated));
         }
+        processed_deflate = true;
       } while (ret != Z_STREAM_END);
 
-      curr->deflate_len = st.st_size - strm.avail_in - pos;
+      curr->deflate_len = sz - strm.avail_in - pos;
       inflateEnd(&strm);
       pos += curr->deflate_len;
       p += curr->deflate_len;
@@ -493,8 +505,8 @@ unsigned char* ReadImage(const char* filename,
       // the decompression.
       size_t footer_size = Read4(p-4);
       if (footer_size != curr[-2].len) {
-        printf("Error: footer size %d != decompressed size %d\n",
-                footer_size, curr[-2].len);
+        printf("Error: footer size %zu != decompressed size %zu\n",
+            footer_size, curr[-2].len);
         free(img);
         return NULL;
       }
@@ -502,7 +514,7 @@ unsigned char* ReadImage(const char* filename,
       // Reallocate the list for every chunk; we expect the number of
       // chunks to be small (5 for typical boot and recovery images).
       ++*num_chunks;
-      *chunks = realloc(*chunks, *num_chunks * sizeof(ImageChunk));
+      *chunks = reinterpret_cast<ImageChunk*>(realloc(*chunks, *num_chunks * sizeof(ImageChunk)));
       ImageChunk* curr = *chunks + (*num_chunks-1);
       curr->start = pos;
       curr->I = NULL;
@@ -512,7 +524,7 @@ unsigned char* ReadImage(const char* filename,
       curr->type = CHUNK_NORMAL;
       curr->data = p;
 
-      for (curr->len = 0; curr->len < (st.st_size - pos); ++curr->len) {
+      for (curr->len = 0; curr->len < (sz - pos); ++curr->len) {
         if (p[curr->len] == 0x1f &&
             p[curr->len+1] == 0x8b &&
             p[curr->len+2] == 0x08 &&
@@ -587,7 +599,7 @@ int ReconstructDeflateChunk(ImageChunk* chunk) {
   }
 
   size_t p = 0;
-  unsigned char* out = malloc(BUFFER_SIZE);
+  unsigned char* out = reinterpret_cast<unsigned char*>(malloc(BUFFER_SIZE));
 
   // We only check two combinations of encoder parameters:  level 6
   // (the default) and level 9 (the maximum).
@@ -623,7 +635,15 @@ unsigned char* MakePatch(ImageChunk* src, ImageChunk* tgt, size_t* size) {
   }
 
   char ptemp[] = "/tmp/imgdiff-patch-XXXXXX";
-  mkstemp(ptemp);
+  int fd = mkstemp(ptemp);
+
+  if (fd == -1) {
+    printf("MakePatch failed to create a temporary file: %s\n",
+           strerror(errno));
+    return NULL;
+  }
+  close(fd); // temporary file is created and we don't need its file
+             // descriptor
 
   int r = bsdiff(src->data, src->len, &(src->I), tgt->data, tgt->len, ptemp);
   if (r != 0) {
@@ -638,9 +658,11 @@ unsigned char* MakePatch(ImageChunk* src, ImageChunk* tgt, size_t* size) {
     return NULL;
   }
 
-  unsigned char* data = malloc(st.st_size);
+  size_t sz = static_cast<size_t>(st.st_size);
+  // TODO: Memory leak on error return.
+  unsigned char* data = reinterpret_cast<unsigned char*>(malloc(sz));
 
-  if (tgt->type == CHUNK_NORMAL && tgt->len <= st.st_size) {
+  if (tgt->type == CHUNK_NORMAL && tgt->len <= sz) {
     unlink(ptemp);
 
     tgt->type = CHUNK_RAW;
@@ -648,14 +670,14 @@ unsigned char* MakePatch(ImageChunk* src, ImageChunk* tgt, size_t* size) {
     return tgt->data;
   }
 
-  *size = st.st_size;
+  *size = sz;
 
   FILE* f = fopen(ptemp, "rb");
   if (f == NULL) {
     printf("failed to open patch %s: %s\n", ptemp, strerror(errno));
     return NULL;
   }
-  if (fread(data, 1, st.st_size, f) != st.st_size) {
+  if (fread(data, 1, sz, f) != sz) {
     printf("failed to read patch %s: %s\n", ptemp, strerror(errno));
     return NULL;
   }
@@ -781,9 +803,8 @@ ImageChunk* FindChunkByName(const char* name,
 }
 
 void DumpChunks(ImageChunk* chunks, int num_chunks) {
-    int i;
-    for (i = 0; i < num_chunks; ++i) {
-        printf("chunk %d: type %d start %d len %d\n",
+    for (int i = 0; i < num_chunks; ++i) {
+        printf("chunk %d: type %d start %zu len %zu\n",
                i, chunks[i].type, chunks[i].start, chunks[i].len);
     }
 }
@@ -806,7 +827,7 @@ int main(int argc, char** argv) {
       return 1;
     }
     bonus_size = st.st_size;
-    bonus_data = malloc(bonus_size);
+    bonus_data = reinterpret_cast<unsigned char*>(malloc(bonus_size));
     FILE* f = fopen(argv[2], "rb");
     if (f == NULL) {
       printf("failed to open bonus file %s: %s\n", argv[2], strerror(errno));
@@ -953,8 +974,9 @@ int main(int argc, char** argv) {
   DumpChunks(src_chunks, num_src_chunks);
 
   printf("Construct patches for %d chunks...\n", num_tgt_chunks);
-  unsigned char** patch_data = malloc(num_tgt_chunks * sizeof(unsigned char*));
-  size_t* patch_size = malloc(num_tgt_chunks * sizeof(size_t));
+  unsigned char** patch_data = reinterpret_cast<unsigned char**>(malloc(
+      num_tgt_chunks * sizeof(unsigned char*)));
+  size_t* patch_size = reinterpret_cast<size_t*>(malloc(num_tgt_chunks * sizeof(size_t)));
   for (i = 0; i < num_tgt_chunks; ++i) {
     if (zip_mode) {
       ImageChunk* src;
@@ -967,15 +989,16 @@ int main(int argc, char** argv) {
       }
     } else {
       if (i == 1 && bonus_data) {
-        printf("  using %d bytes of bonus data for chunk %d\n", bonus_size, i);
-        src_chunks[i].data = realloc(src_chunks[i].data, src_chunks[i].len + bonus_size);
+        printf("  using %zu bytes of bonus data for chunk %d\n", bonus_size, i);
+        src_chunks[i].data = reinterpret_cast<unsigned char*>(realloc(src_chunks[i].data,
+            src_chunks[i].len + bonus_size));
         memcpy(src_chunks[i].data+src_chunks[i].len, bonus_data, bonus_size);
         src_chunks[i].len += bonus_size;
      }
 
       patch_data[i] = MakePatch(src_chunks+i, tgt_chunks+i, patch_size+i);
     }
-    printf("patch %3d is %d bytes (of %d)\n",
+    printf("patch %3d is %zu bytes (of %zu)\n",
            i, patch_size[i], tgt_chunks[i].source_len);
   }
 
@@ -1012,7 +1035,7 @@ int main(int argc, char** argv) {
 
     switch (tgt_chunks[i].type) {
       case CHUNK_NORMAL:
-        printf("chunk %3d: normal   (%10d, %10d)  %10d\n", i,
+        printf("chunk %3d: normal   (%10zu, %10zu)  %10zu\n", i,
                tgt_chunks[i].start, tgt_chunks[i].len, patch_size[i]);
         Write8(tgt_chunks[i].source_start, f);
         Write8(tgt_chunks[i].source_len, f);
@@ -1021,7 +1044,7 @@ int main(int argc, char** argv) {
         break;
 
       case CHUNK_DEFLATE:
-        printf("chunk %3d: deflate  (%10d, %10d)  %10d  %s\n", i,
+        printf("chunk %3d: deflate  (%10zu, %10zu)  %10zu  %s\n", i,
                tgt_chunks[i].start, tgt_chunks[i].deflate_len, patch_size[i],
                tgt_chunks[i].filename);
         Write8(tgt_chunks[i].source_start, f);
@@ -1038,7 +1061,7 @@ int main(int argc, char** argv) {
         break;
 
       case CHUNK_RAW:
-        printf("chunk %3d: raw      (%10d, %10d)\n", i,
+        printf("chunk %3d: raw      (%10zu, %10zu)\n", i,
                tgt_chunks[i].start, tgt_chunks[i].len);
         Write4(patch_size[i], f);
         fwrite(patch_data[i], 1, patch_size[i], f);
diff --git a/applypatch/imgpatch.c b/applypatch/imgpatch.cpp
index 09b0a7397..d175d6385 100644
--- a/applypatch/imgpatch.c
+++ b/applypatch/imgpatch.cpp
@@ -21,23 +21,33 @@
 #include <sys/cdefs.h>
 #include <sys/stat.h>
 #include <errno.h>
-#include <malloc.h>
 #include <unistd.h>
 #include <string.h>
 
+#include <vector>
+
 #include "zlib.h"
-#include "mincrypt/sha.h"
+#include "openssl/sha.h"
 #include "applypatch.h"
 #include "imgdiff.h"
 #include "utils.h"
 
+int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size,
+                    const unsigned char* patch_data, ssize_t patch_size,
+                    SinkFn sink, void* token) {
+  Value patch = {VAL_BLOB, patch_size,
+      reinterpret_cast<char*>(const_cast<unsigned char*>(patch_data))};
+  return ApplyImagePatch(
+      old_data, old_size, &patch, sink, token, nullptr, nullptr);
+}
+
 /*
  * Apply the patch given in 'patch_filename' to the source data given
  * by (old_data, old_size).  Write the patched output to the 'output'
  * file, and update the SHA context with the output data as well.
  * Return 0 on success.
  */
-int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
+int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size,
                     const Value* patch,
                     SinkFn sink, void* token, SHA_CTX* ctx,
                     const Value* bonus_data) {
@@ -80,6 +90,10 @@ int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
             size_t src_len = Read8(normal_header+8);
             size_t patch_offset = Read8(normal_header+16);
 
+            if (src_start + src_len > static_cast<size_t>(old_size)) {
+                printf("source data too short\n");
+                return -1;
+            }
             ApplyBSDiffPatch(old_data + src_start, src_len,
                              patch, patch_offset, sink, token, ctx);
         } else if (type == CHUNK_RAW) {
@@ -96,7 +110,7 @@ int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
                 printf("failed to read chunk %d raw data\n", i);
                 return -1;
             }
-            if (ctx) SHA_update(ctx, patch->data + pos, data_len);
+            if (ctx) SHA1_Update(ctx, patch->data + pos, data_len);
             if (sink((unsigned char*)patch->data + pos,
                      data_len, token) != data_len) {
                 printf("failed to write chunk %d raw data\n", i);
@@ -116,13 +130,17 @@ int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
             size_t src_len = Read8(deflate_header+8);
             size_t patch_offset = Read8(deflate_header+16);
             size_t expanded_len = Read8(deflate_header+24);
-            size_t target_len = Read8(deflate_header+32);
             int level = Read4(deflate_header+40);
             int method = Read4(deflate_header+44);
             int windowBits = Read4(deflate_header+48);
             int memLevel = Read4(deflate_header+52);
             int strategy = Read4(deflate_header+56);
 
+            if (src_start + src_len > static_cast<size_t>(old_size)) {
+                printf("source data too short\n");
+                return -1;
+            }
+
             // Decompress the source data; the chunk header tells us exactly
             // how big we expect it to be when decompressed.
 
@@ -132,57 +150,54 @@ int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
             // must be appended from the bonus_data value.
             size_t bonus_size = (i == 1 && bonus_data != NULL) ? bonus_data->size : 0;
 
-            unsigned char* expanded_source = malloc(expanded_len);
-            if (expanded_source == NULL) {
-                printf("failed to allocate %zu bytes for expanded_source\n",
-                       expanded_len);
-                return -1;
-            }
-
-            z_stream strm;
-            strm.zalloc = Z_NULL;
-            strm.zfree = Z_NULL;
-            strm.opaque = Z_NULL;
-            strm.avail_in = src_len;
-            strm.next_in = (unsigned char*)(old_data + src_start);
-            strm.avail_out = expanded_len;
-            strm.next_out = expanded_source;
-
-            int ret;
-            ret = inflateInit2(&strm, -15);
-            if (ret != Z_OK) {
-                printf("failed to init source inflation: %d\n", ret);
-                return -1;
-            }
+            std::vector<unsigned char> expanded_source(expanded_len);
+
+            // inflate() doesn't like strm.next_out being a nullptr even with
+            // avail_out being zero (Z_STREAM_ERROR).
+            if (expanded_len != 0) {
+                z_stream strm;
+                strm.zalloc = Z_NULL;
+                strm.zfree = Z_NULL;
+                strm.opaque = Z_NULL;
+                strm.avail_in = src_len;
+                strm.next_in = (unsigned char*)(old_data + src_start);
+                strm.avail_out = expanded_len;
+                strm.next_out = expanded_source.data();
+
+                int ret;
+                ret = inflateInit2(&strm, -15);
+                if (ret != Z_OK) {
+                    printf("failed to init source inflation: %d\n", ret);
+                    return -1;
+                }
 
-            // Because we've provided enough room to accommodate the output
-            // data, we expect one call to inflate() to suffice.
-            ret = inflate(&strm, Z_SYNC_FLUSH);
-            if (ret != Z_STREAM_END) {
-                printf("source inflation returned %d\n", ret);
-                return -1;
-            }
-            // We should have filled the output buffer exactly, except
-            // for the bonus_size.
-            if (strm.avail_out != bonus_size) {
-                printf("source inflation short by %zu bytes\n", strm.avail_out-bonus_size);
-                return -1;
-            }
-            inflateEnd(&strm);
+                // Because we've provided enough room to accommodate the output
+                // data, we expect one call to inflate() to suffice.
+                ret = inflate(&strm, Z_SYNC_FLUSH);
+                if (ret != Z_STREAM_END) {
+                    printf("source inflation returned %d\n", ret);
+                    return -1;
+                }
+                // We should have filled the output buffer exactly, except
+                // for the bonus_size.
+                if (strm.avail_out != bonus_size) {
+                    printf("source inflation short by %zu bytes\n", strm.avail_out-bonus_size);
+                    return -1;
+                }
+                inflateEnd(&strm);
 
-            if (bonus_size) {
-                memcpy(expanded_source + (expanded_len - bonus_size),
-                       bonus_data->data, bonus_size);
+                if (bonus_size) {
+                    memcpy(expanded_source.data() + (expanded_len - bonus_size),
+                           bonus_data->data, bonus_size);
+                }
             }
 
             // Next, apply the bsdiff patch (in memory) to the uncompressed
             // data.
-            unsigned char* uncompressed_target_data;
-            ssize_t uncompressed_target_size;
-            if (ApplyBSDiffPatchMem(expanded_source, expanded_len,
+            std::vector<unsigned char> uncompressed_target_data;
+            if (ApplyBSDiffPatchMem(expanded_source.data(), expanded_len,
                                     patch, patch_offset,
-                                    &uncompressed_target_data,
-                                    &uncompressed_target_size) != 0) {
+                                    &uncompressed_target_data) != 0) {
                 return -1;
             }
 
@@ -190,40 +205,40 @@ int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size __unused,
 
             // we're done with the expanded_source data buffer, so we'll
             // reuse that memory to receive the output of deflate.
-            unsigned char* temp_data = expanded_source;
-            ssize_t temp_size = expanded_len;
-            if (temp_size < 32768) {
-                // ... unless the buffer is too small, in which case we'll
-                // allocate a fresh one.
-                free(temp_data);
-                temp_data = malloc(32768);
-                temp_size = 32768;
+            if (expanded_source.size() < 32768U) {
+                expanded_source.resize(32768U);
             }
 
-            // now the deflate stream
-            strm.zalloc = Z_NULL;
-            strm.zfree = Z_NULL;
-            strm.opaque = Z_NULL;
-            strm.avail_in = uncompressed_target_size;
-            strm.next_in = uncompressed_target_data;
-            ret = deflateInit2(&strm, level, method, windowBits, memLevel, strategy);
-            do {
-                strm.avail_out = temp_size;
-                strm.next_out = temp_data;
-                ret = deflate(&strm, Z_FINISH);
-                ssize_t have = temp_size - strm.avail_out;
-
-                if (sink(temp_data, have, token) != have) {
-                    printf("failed to write %ld compressed bytes to output\n",
-                           (long)have);
+            {
+                std::vector<unsigned char>& temp_data = expanded_source;
+
+                // now the deflate stream
+                z_stream strm;
+                strm.zalloc = Z_NULL;
+                strm.zfree = Z_NULL;
+                strm.opaque = Z_NULL;
+                strm.avail_in = uncompressed_target_data.size();
+                strm.next_in = uncompressed_target_data.data();
+                int ret = deflateInit2(&strm, level, method, windowBits, memLevel, strategy);
+                if (ret != Z_OK) {
+                    printf("failed to init uncompressed data deflation: %d\n", ret);
                     return -1;
                 }
-                if (ctx) SHA_update(ctx, temp_data, have);
-            } while (ret != Z_STREAM_END);
-            deflateEnd(&strm);
-
-            free(temp_data);
-            free(uncompressed_target_data);
+                do {
+                    strm.avail_out = temp_data.size();
+                    strm.next_out = temp_data.data();
+                    ret = deflate(&strm, Z_FINISH);
+                    ssize_t have = temp_data.size() - strm.avail_out;
+
+                    if (sink(temp_data.data(), have, token) != have) {
+                        printf("failed to write %ld compressed bytes to output\n",
+                               (long)have);
+                        return -1;
+                    }
+                    if (ctx) SHA1_Update(ctx, temp_data.data(), have);
+                } while (ret != Z_STREAM_END);
+                deflateEnd(&strm);
+            }
         } else {
             printf("patch chunk %d is unknown type %d\n", i, type);
             return -1;
diff --git a/applypatch/include/applypatch/imgpatch.h b/applypatch/include/applypatch/imgpatch.h
new file mode 100644
index 000000000..64d9aa9eb
--- /dev/null
+++ b/applypatch/include/applypatch/imgpatch.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _IMGPATCH_H
+#define _IMGPATCH_H
+
+typedef ssize_t (*SinkFn)(const unsigned char*, ssize_t, void*);
+
+int ApplyImagePatch(const unsigned char* old_data, ssize_t old_size,
+                    const unsigned char* patch_data, ssize_t patch_size,
+                    SinkFn sink, void* token);
+
+#endif  //_IMGPATCH_H
diff --git a/applypatch/main.c b/applypatch/main.cpp
index 8e9fe80ef..9013760c4 100644
--- a/applypatch/main.c
+++ b/applypatch/main.cpp
@@ -19,18 +19,21 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <memory>
+#include <vector>
+
 #include "applypatch.h"
 #include "edify/expr.h"
-#include "mincrypt/sha.h"
+#include "openssl/sha.h"
 
-int CheckMode(int argc, char** argv) {
+static int CheckMode(int argc, char** argv) {
     if (argc < 3) {
         return 2;
     }
     return applypatch_check(argv[2], argc-3, argv+3);
 }
 
-int SpaceMode(int argc, char** argv) {
+static int SpaceMode(int argc, char** argv) {
     if (argc != 3) {
         return 2;
     }
@@ -43,79 +46,60 @@ int SpaceMode(int argc, char** argv) {
     return CacheSizeCheck(bytes);
 }
 
-// Parse arguments (which should be of the form "<sha1>" or
-// "<sha1>:<filename>" into the new parallel arrays *sha1s and
-// *patches (loading file contents into the patches).  Returns 0 on
+// Parse arguments (which should be of the form "<sha1>:<filename>"
+// into the new parallel arrays *sha1s and *files.Returns true on
 // success.
-static int ParsePatchArgs(int argc, char** argv,
-                          char*** sha1s, Value*** patches, int* num_patches) {
-    *num_patches = argc;
-    *sha1s = malloc(*num_patches * sizeof(char*));
-    *patches = malloc(*num_patches * sizeof(Value*));
-    memset(*patches, 0, *num_patches * sizeof(Value*));
-
-    uint8_t digest[SHA_DIGEST_SIZE];
+static bool ParsePatchArgs(int argc, char** argv, std::vector<char*>* sha1s,
+                           std::vector<FileContents>* files) {
+    uint8_t digest[SHA_DIGEST_LENGTH];
 
-    int i;
-    for (i = 0; i < *num_patches; ++i) {
+    for (int i = 0; i < argc; ++i) {
         char* colon = strchr(argv[i], ':');
-        if (colon != NULL) {
-            *colon = '\0';
-            ++colon;
+        if (colon == nullptr) {
+            printf("no ':' in patch argument \"%s\"\n", argv[i]);
+            return false;
         }
-
+        *colon = '\0';
+        ++colon;
         if (ParseSha1(argv[i], digest) != 0) {
             printf("failed to parse sha1 \"%s\"\n", argv[i]);
-            return -1;
+            return false;
         }
 
-        (*sha1s)[i] = argv[i];
-        if (colon == NULL) {
-            (*patches)[i] = NULL;
-        } else {
-            FileContents fc;
-            if (LoadFileContents(colon, &fc) != 0) {
-                goto abort;
-            }
-            (*patches)[i] = malloc(sizeof(Value));
-            (*patches)[i]->type = VAL_BLOB;
-            (*patches)[i]->size = fc.size;
-            (*patches)[i]->data = (char*)fc.data;
+        sha1s->push_back(argv[i]);
+        FileContents fc;
+        if (LoadFileContents(colon, &fc) != 0) {
+            return false;
         }
+        files->push_back(std::move(fc));
     }
+    return true;
+}
 
-    return 0;
-
-  abort:
-    for (i = 0; i < *num_patches; ++i) {
-        Value* p = (*patches)[i];
-        if (p != NULL) {
-            free(p->data);
-            free(p);
-        }
-    }
-    free(*sha1s);
-    free(*patches);
-    return -1;
+static int FlashMode(const char* src_filename, const char* tgt_filename,
+                     const char* tgt_sha1, size_t tgt_size) {
+    return applypatch_flash(src_filename, tgt_filename, tgt_sha1, tgt_size);
 }
 
-int PatchMode(int argc, char** argv) {
-    Value* bonus = NULL;
+static int PatchMode(int argc, char** argv) {
+    FileContents bonusFc;
+    Value bonusValue;
+    Value* bonus = nullptr;
+
     if (argc >= 3 && strcmp(argv[1], "-b") == 0) {
-        FileContents fc;
-        if (LoadFileContents(argv[2], &fc) != 0) {
+        if (LoadFileContents(argv[2], &bonusFc) != 0) {
             printf("failed to load bonus file %s\n", argv[2]);
             return 1;
         }
-        bonus = malloc(sizeof(Value));
+        bonus = &bonusValue;
         bonus->type = VAL_BLOB;
-        bonus->size = fc.size;
-        bonus->data = (char*)fc.data;
+        bonus->size = bonusFc.data.size();
+        bonus->data = reinterpret_cast<char*>(bonusFc.data.data());
         argc -= 2;
         argv += 2;
     }
 
-    if (argc < 6) {
+    if (argc < 4) {
         return 2;
     }
 
@@ -126,33 +110,31 @@ int PatchMode(int argc, char** argv) {
         return 1;
     }
 
-    char** sha1s;
-    Value** patches;
-    int num_patches;
-    if (ParsePatchArgs(argc-5, argv+5, &sha1s, &patches, &num_patches) != 0) {
+    // If no <src-sha1>:<patch> is provided, it is in flash mode.
+    if (argc == 5) {
+        if (bonus != nullptr) {
+            printf("bonus file not supported in flash mode\n");
+            return 1;
+        }
+        return FlashMode(argv[1], argv[2], argv[3], target_size);
+    }
+    std::vector<char*> sha1s;
+    std::vector<FileContents> files;
+    if (!ParsePatchArgs(argc-5, argv+5, &sha1s, &files)) {
         printf("failed to parse patch args\n");
         return 1;
     }
-
-    int result = applypatch(argv[1], argv[2], argv[3], target_size,
-                            num_patches, sha1s, patches, bonus);
-
-    int i;
-    for (i = 0; i < num_patches; ++i) {
-        Value* p = patches[i];
-        if (p != NULL) {
-            free(p->data);
-            free(p);
-        }
-    }
-    if (bonus) {
-        free(bonus->data);
-        free(bonus);
+    std::vector<Value> patches(files.size());
+    std::vector<Value*> patch_ptrs(files.size());
+    for (size_t i = 0; i < files.size(); ++i) {
+        patches[i].type = VAL_BLOB;
+        patches[i].size = files[i].data.size();
+        patches[i].data = reinterpret_cast<char*>(files[i].data.data());
+        patch_ptrs[i] = &patches[i];
     }
-    free(sha1s);
-    free(patches);
-
-    return result;
+    return applypatch(argv[1], argv[2], argv[3], target_size,
+                      patch_ptrs.size(), sha1s.data(),
+                      patch_ptrs.data(), bonus);
 }
 
 // This program applies binary patches to files in a way that is safe
@@ -163,6 +145,10 @@ int PatchMode(int argc, char** argv) {
 // - if the sha1 hash of <tgt-file> is <tgt-sha1>, does nothing and exits
 //   successfully.
 //
+// - otherwise, if no <src-sha1>:<patch> is provided, flashes <tgt-file> with
+//   <src-file>. <tgt-file> must be a partition name, while <src-file> must
+//   be a regular image file. <src-file> will not be deleted on success.
+//
 // - otherwise, if the sha1 hash of <src-file> is <src-sha1>, applies the
 //   bsdiff <patch> to <src-file> to produce a new file (the type of patch
 //   is automatically detected from the file header).  If that new
diff --git a/applypatch/utils.c b/applypatch/utils.cpp
index 41ff676dc..4a80be75f 100644
--- a/applypatch/utils.c
+++ b/applypatch/utils.cpp
@@ -39,13 +39,13 @@ void Write8(long long value, FILE* f) {
 }
 
 int Read2(void* pv) {
-    unsigned char* p = pv;
+    unsigned char* p = reinterpret_cast<unsigned char*>(pv);
     return (int)(((unsigned int)p[1] << 8) |
                  (unsigned int)p[0]);
 }
 
 int Read4(void* pv) {
-    unsigned char* p = pv;
+    unsigned char* p = reinterpret_cast<unsigned char*>(pv);
     return (int)(((unsigned int)p[3] << 24) |
                  ((unsigned int)p[2] << 16) |
                  ((unsigned int)p[1] << 8) |
@@ -53,7 +53,7 @@ int Read4(void* pv) {
 }
 
 long long Read8(void* pv) {
-    unsigned char* p = pv;
+    unsigned char* p = reinterpret_cast<unsigned char*>(pv);
     return (long long)(((unsigned long long)p[7] << 56) |
                        ((unsigned long long)p[6] << 48) |
                        ((unsigned long long)p[5] << 40) |