OSDN Git Service

Fix DynamicRefTable::load security bug
authorRyan Mitchell <rtmitchell@google.com>
Wed, 30 May 2018 19:17:01 +0000 (12:17 -0700)
committerRyan Longair <rlongair@google.com>
Tue, 12 Jun 2018 18:14:52 +0000 (11:14 -0700)
commitd33e25ebc5ede60ead3916aeba9e01228fb9e197
tree1e7404134086c4579c55cb9ab914235024af1695
parenta8faaefba2aee4df0673014dbc4c263d1c6d9ad1
Fix DynamicRefTable::load security bug

DynamicRefTables parsed from apks are missing bounds checks that prevent
buffer overflows. This changes verifies the bounds of the header before
attempting to preform operations on the chunk.

Bug: 79488511
Test: run cts -m CtsAppSecurityHostTestCases \
        -t android.appsecurity.cts.CorruptApkTests

Change-Id: I02c8ad957da244fce777ac68a482e4e8fa70f846
Merged-In: I02c8ad957da244fce777ac68a482e4e8fa70f846
(cherry picked from commit 8cf0f988b0c64bcf2c199bb76439c51c257dd162)
libs/androidfw/ResourceTypes.cpp