Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix security issue in DynamicRefTable::load." into qt-qpr1-dev

Browse Source
This commit is contained in:
TreeHugger Robot
2020-03-23 19:02:33 +00:00
committed by Android (Google) Code Review
parent 7c64b0da0d aff8e2d83d
commit 084cc32ce8
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libs/androidfw/ResourceTypes.cpp
View File

@@ -6902,9 +6902,8 @@ std::unique_ptr<DynamicRefTable> DynamicRefTable::clone() const {
status_t DynamicRefTable::load(const ResTable_lib_header* const header) status_t DynamicRefTable::load(const ResTable_lib_header* const header)
{ {
const uint32_t entryCount = dtohl(header->count); const uint32_t entryCount = dtohl(header->count);
const uint32_t sizeOfEntries = sizeof(ResTable_lib_entry) * entryCount;
const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize); const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize);
if (sizeOfEntries > expectedSize) { if (entryCount > (expectedSize / sizeof(ResTable_lib_entry))) {
ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).", ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).",
expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry)); expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry));
return UNKNOWN_ERROR; return UNKNOWN_ERROR;