drgreen/android_frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AAPT: Fix use-after-free error

Browse Source 
Re-order deletion of ResXMLTree and the Asset object
it iterates over.

Bug:30844391
Change-Id: Ied033d0a8f93343006228a2054c6d0f42bb4717a
This commit is contained in:
Adam Lesinski
2016-08-15 14:19:46 -07:00
parent 58635e74ed
commit 193ed74c2d
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
tools/aapt/Resource.cpp
View File

@ -1033,7 +1033,6 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
return NO_ERROR; return NO_ERROR;
} }
ResXMLTree tree;
Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING); Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);
if (asset == NULL) { if (asset == NULL) {
fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n"); fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
@ -1041,11 +1040,17 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
} }
ssize_t result = NO_ERROR; ssize_t result = NO_ERROR;
if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n"); // Create a new scope so that ResXMLTree is destroyed before we delete the memory over
result = UNKNOWN_ERROR; // which it iterates (asset).
} else { {
result = extractPlatformBuildVersion(tree, bundle); ResXMLTree tree;
if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");
result = UNKNOWN_ERROR;
} else {
result = extractPlatformBuildVersion(tree, bundle);
}
} }
delete asset; delete asset;