Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11fef4e7 authored by Ryan Mitchell's avatar Ryan Mitchell Committed by Android (Google) Code Review
Browse files

Merge "Fix security issue in DynamicRefTable::load."

parents 007ecbb8 8da1c38b

libs/androidfw/ResourceTypes.cpp

+1 −2
Original line number Diff line number Diff line
@@ -6902,9 +6902,8 @@ std::unique_ptr<DynamicRefTable> DynamicRefTable::clone() const { 
status_t DynamicRefTable::load(const ResTable_lib_header* const header)

{

    const uint32_t entryCount = dtohl(header->count);

    const uint32_t sizeOfEntries = sizeof(ResTable_lib_entry) * entryCount;

    const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize);

    if (sizeOfEntries > expectedSize) {

    if (entryCount > (expectedSize / sizeof(ResTable_lib_entry))) {

        ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).",

                expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry));

        return UNKNOWN_ERROR;