Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae8180c0 authored by Tianjie Xu's avatar Tianjie Xu
Browse files

Fix out of bound access in libziparchive 

The boundary check of an invalid EOCD record may succeed due to the
overflow of uint32_t. Fix the check and add a unit test.

Test: Open the crash.apk and libziparchive reports the offset error as expected.

Bug: 31251826
Change-Id: I1d8092a19b73886a671bc9d291cfc27d65e3d236
parent 7c9800df

libziparchive/testdata/crash.apk

0 → 100644
+154 B

File added.

No diff preview for this file type.

View file

libziparchive/zip_archive.cc

+6 −1
Original line number Diff line number Diff line
@@ -270,9 +270,14 @@ static int32_t MapCentralDirectory0(int fd, const char* debug_file_name, 
   * Grab the CD offset and size, and the number of entries in the

   * archive and verify that they look reasonable.

   */

  if (eocd->cd_start_offset + eocd->cd_size > eocd_offset) {

  if (static_cast<off64_t>(eocd->cd_start_offset) + eocd->cd_size > eocd_offset) {

    ALOGW("Zip: bad offsets (dir %" PRIu32 ", size %" PRIu32 ", eocd %" PRId64 ")",

        eocd->cd_start_offset, eocd->cd_size, static_cast<int64_t>(eocd_offset));

#if defined(__ANDROID__)

    if (eocd->cd_start_offset + eocd->cd_size <= eocd_offset) {

      android_errorWriteLog(0x534e4554, "31251826");

    }

#endif

    return kInvalidOffset;

  }

  if (eocd->num_records == 0) {

libziparchive/zip_archive_test.cc

+7 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ static const std::string kMissingZip = "missing.zip"; 
static const std::string kValidZip = "valid.zip";

static const std::string kLargeZip = "large.zip";

static const std::string kBadCrcZip = "bad_crc.zip";

static const std::string kCrashApk = "crash.apk";



static const std::vector<uint8_t> kATxtContents {

  'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h',
@@ -84,6 +85,12 @@ TEST(ziparchive, Open) { 
  CloseArchive(handle);

}



TEST(ziparchive, OutOfBound) {

  ZipArchiveHandle handle;

  ASSERT_EQ(-8, OpenArchiveWrapper(kCrashApk, &handle));

  CloseArchive(handle);

}



TEST(ziparchive, OpenMissing) {

  ZipArchiveHandle handle;

  ASSERT_NE(0, OpenArchiveWrapper(kMissingZip, &handle));