Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix DynamicRefTable::load security bug

Browse Source 
DynamicRefTables parsed from apks are missing bounds checks that prevent
buffer overflows. This changes verifies the bounds of the header before
attempting to preform operations on the chunk.

Bug: 79488511
Test: run cts -m CtsAppSecurityHostTestCases \
        -t android.appsecurity.cts.CorruptApkTests

Change-Id: I02c8ad957da244fce777ac68a482e4e8fa70f846
Merged-In: I02c8ad957da244fce777ac68a482e4e8fa70f846
This commit is contained in:
Ryan Mitchell
2018-05-30 12:17:01 -07:00
parent 857326e373
commit 8cf0f988b0
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libs/androidfw/ResourceTypes.cpp
View File

@@ -6220,8 +6220,16 @@ status_t ResTable::parsePackage(const ResTable_package* const pkg,
}
} else if (ctype == RES_TABLE_LIBRARY_TYPE) {
if (group->dynamicRefTable.entries().size() == 0) {
status_t err = group->dynamicRefTable.load((const ResTable_lib_header*) chunk);
const ResTable_lib_header* lib = (const ResTable_lib_header*) chunk;
status_t err = validate_chunk(&lib->header, sizeof(*lib),
endPos, "ResTable_lib_header");
if (err != NO_ERROR) {
return (mError=err);
}
err = group->dynamicRefTable.load(lib);
if (err != NO_ERROR) {
return (mError=err);
}