Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix potential crash in libandroidfw

Browse Source 
A malformed APK may cause a crash if it
encodes its chunk size as a signed number
(MSB set to 1).

Bug:14898892
Change-Id: I342853c2b0859e5be15d712d451323afc367d329
This commit is contained in:
Adam Lesinski
2014-05-14 11:43:26 -07:00
parent da86f784b6
commit 7322ea7b73
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libs/androidfw/ResourceTypes.cpp
View File

@@ -102,7 +102,7 @@ static status_t validate_chunk(const ResChunk_header* chunk,
if (headerSize >= minSize) {
if (headerSize <= size) {
if (((headerSize|size)&0x3) == 0) {
if ((ssize_t)size <= (dataEnd-((const uint8_t*)chunk))) {
if ((size_t)size <= (size_t)(dataEnd-((const uint8_t*)chunk))) {
return NO_ERROR;
}
ALOGW("%s data size 0x%x extends beyond resource end %p.",