AAPT: Fix use-after-free error
Re-order deletion of ResXMLTree and the Asset object it iterates over. Bug:30844391 Change-Id: Ied033d0a8f93343006228a2054c6d0f42bb4717a
This commit is contained in:
@ -1033,7 +1033,6 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
|
|||||||
return NO_ERROR;
|
return NO_ERROR;
|
||||||
}
|
}
|
||||||
|
|
||||||
ResXMLTree tree;
|
|
||||||
Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);
|
Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);
|
||||||
if (asset == NULL) {
|
if (asset == NULL) {
|
||||||
fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
|
fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
|
||||||
@ -1041,11 +1040,17 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
|
|||||||
}
|
}
|
||||||
|
|
||||||
ssize_t result = NO_ERROR;
|
ssize_t result = NO_ERROR;
|
||||||
if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
|
|
||||||
fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");
|
// Create a new scope so that ResXMLTree is destroyed before we delete the memory over
|
||||||
result = UNKNOWN_ERROR;
|
// which it iterates (asset).
|
||||||
} else {
|
{
|
||||||
result = extractPlatformBuildVersion(tree, bundle);
|
ResXMLTree tree;
|
||||||
|
if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
|
||||||
|
fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");
|
||||||
|
result = UNKNOWN_ERROR;
|
||||||
|
} else {
|
||||||
|
result = extractPlatformBuildVersion(tree, bundle);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
delete asset;
|
delete asset;
|
||||||
|
Reference in New Issue
Block a user