Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35a8a116 authored by Kyeongkab.Nam's avatar Kyeongkab.Nam
Browse files

Fix bootanimation stack overflow 

length of input from scanf is not limited even though MAX char of path
is defined as 256. This could cause stack corruption when length of input
is over MAX.

Test: run bootanimation with desc.txt which has over 256 length of path.

Change-Id: Ic60081ca82067ad671508e766c495546af9233d1
parent d1379a4a

cmds/bootanimation/BootAnimation.cpp

+6 −2
Original line number Diff line number Diff line
@@ -63,6 +63,10 @@ 


#include "BootAnimation.h"



#define ANIM_PATH_MAX 255

#define STR(x)   #x

#define STRTO(x) STR(x)



namespace android {



static const char OEM_BOOTANIMATION_FILE[] = "/oem/media/bootanimation.zip";
@@ -94,7 +98,7 @@ static constexpr size_t FONT_NUM_ROWS = FONT_NUM_CHARS / FONT_NUM_COLS; 
static const int TEXT_CENTER_VALUE = INT_MAX;

static const int TEXT_MISSING_VALUE = INT_MIN;

static const char EXIT_PROP_NAME[] = "service.bootanim.exit";

static const int ANIM_ENTRY_NAME_MAX = 256;

static const int ANIM_ENTRY_NAME_MAX = ANIM_PATH_MAX + 1;

static constexpr size_t TEXT_POS_LEN_MAX = 16;



// ---------------------------------------------------------------------------
@@ -658,7 +662,7 @@ bool BootAnimation::parseAnimationDesc(Animation& animation) 
            animation.width = width;

            animation.height = height;

            animation.fps = fps;

        } else if (sscanf(l, " %c %d %d %s #%6s %16s %16s",

        } else if (sscanf(l, " %c %d %d %" STRTO(ANIM_PATH_MAX) "s #%6s %16s %16s",

                          &pathType, &count, &pause, path, color, clockPos1, clockPos2) >= 4) {

            //ALOGD("> type=%c, count=%d, pause=%d, path=%s, color=%s, clockPos1=%s, clockPos2=%s",

            //    pathType, count, pause, path, color, clockPos1, clockPos2);