Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc1c594d authored by Florian Mayer's avatar Florian Mayer Committed by Android (Google) Code Review
Browse files

Merge "Split condition to prevent out of bounds access."

parents 1679933e a3c3a5a8
Loading
Loading
Loading
Loading
+7 −4
Original line number Diff line number Diff line
@@ -208,11 +208,14 @@ const uint8_t *Reader::findLastValidEntry(const uint8_t *front, const uint8_t *b
    }
    while (back + Entry::kPreviousLengthOffset >= front) {
        const uint8_t *prev = back - back[Entry::kPreviousLengthOffset] - Entry::kOverhead;
        const Event type = (const Event)prev[offsetof(entry, type)];
        if (prev < front
                || prev + prev[offsetof(entry, length)] + Entry::kOverhead != back
                || type <= EVENT_RESERVED || type >= EVENT_UPPER_BOUND) {
            // prev points to an out of limits or inconsistent entry
                || prev + prev[offsetof(entry, length)] + Entry::kOverhead != back) {
            // prev points to an out of limits entry
            return nullptr;
        }
        const Event type = (const Event)prev[offsetof(entry, type)];
        if (type <= EVENT_RESERVED || type >= EVENT_UPPER_BOUND) {
            // prev points to an inconsistent entry
            return nullptr;
        }
        // if invalidTypes does not contain the type, then the type is valid.