Merge "Fix DynamicRefTable::load security bug" into oc-mr1-dev (5ae85666) · Commits · e / os / android_frameworks_base

libs/androidfw/ResourceTypes.cpp

+9 −1

Original line number	Diff line number	Diff line
		@@ -6824,8 +6824,16 @@ status_t ResTable::parsePackage(const ResTable_package* const pkg,
		}

		} else if (ctype == RES_TABLE_LIBRARY_TYPE) {

		if (group->dynamicRefTable.entries().size() == 0) {
		status_t err = group->dynamicRefTable.load((const ResTable_lib_header*) chunk);
		const ResTable_lib_header* lib = (const ResTable_lib_header*) chunk;
		status_t err = validate_chunk(&lib->header, sizeof(*lib),
		endPos, "ResTable_lib_header");
		if (err != NO_ERROR) {
		return (mError=err);
		}

		err = group->dynamicRefTable.load(lib);
		if (err != NO_ERROR) {
		return (mError=err);
		}