Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix security issue in DynamicRefTable::load." into qt-qpr1-dev am: 084cc32ce8

Browse Source 
Change-Id: Ie35cf55cff2162394abae816d1cfb0eefdc0aab6
This commit is contained in:
TreeHugger Robot
2020-03-23 19:38:50 +00:00
committed by Automerger Merge Worker
parent b2a3cb02e5 084cc32ce8
commit be6970b281
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libs/androidfw/ResourceTypes.cpp
View File

@@ -6902,9 +6902,8 @@ std::unique_ptr<DynamicRefTable> DynamicRefTable::clone() const {
status_t DynamicRefTable::load(const ResTable_lib_header* const header)
{
const uint32_t entryCount = dtohl(header->count);
const uint32_t sizeOfEntries = sizeof(ResTable_lib_entry) * entryCount;
const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize);
if (sizeOfEntries > expectedSize) {
if (entryCount > (expectedSize / sizeof(ResTable_lib_entry))) {
ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).",
expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry));
return UNKNOWN_ERROR;