Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 193ed74c authored by Adam Lesinski's avatar Adam Lesinski
Browse files

AAPT: Fix use-after-free error 

Re-order deletion of ResXMLTree and the Asset object
it iterates over.

Bug:30844391
Change-Id: Ied033d0a8f93343006228a2054c6d0f42bb4717a
parent 58635e74

tools/aapt/Resource.cpp

+11 −6
Original line number Diff line number Diff line
@@ -1033,7 +1033,6 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle) 
        return NO_ERROR;

    }



    ResXMLTree tree;

    Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);

    if (asset == NULL) {

        fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
@@ -1041,12 +1040,18 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle) 
    }



    ssize_t result = NO_ERROR;



    // Create a new scope so that ResXMLTree is destroyed before we delete the memory over

    // which it iterates (asset).

    {

        ResXMLTree tree;

        if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {

            fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");

            result = UNKNOWN_ERROR;

        } else {

            result = extractPlatformBuildVersion(tree, bundle);

        }

    }



    delete asset;

    return result;