drgreen/android_frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix security issue in DynamicRefTable::load." into qt-qpr1-dev

Browse Source
This commit is contained in:
TreeHugger Robot 2020-03-23 19:02:33 +00:00 committed by Android (Google) Code Review
commit 084cc32ce8
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libs/androidfw/ResourceTypes.cpp
View File

@ -6902,9 +6902,8 @@ std::unique_ptr<DynamicRefTable> DynamicRefTable::clone() const {
status_t DynamicRefTable::load(const ResTable_lib_header* const header)
{
const uint32_t entryCount = dtohl(header->count);
const uint32_t sizeOfEntries = sizeof(ResTable_lib_entry) * entryCount;
const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize);
if (sizeOfEntries > expectedSize) {
if (entryCount > (expectedSize / sizeof(ResTable_lib_entry))) {
ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).",
expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry));
return UNKNOWN_ERROR;