fix vulnerability in bspatch

Patches with control data tuples with negative numbers in the first
and/or second can cause bspatch to write to arbitrary locations in the
heap.

Change-Id: I8c5d81948be773e6483241131d3d166b6da27cb8

parent 1c2cf1db

applypatch/bspatch.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -205,6 +205,11 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
		ctrl[1] = offtin(buf+8);
		ctrl[2] = offtin(buf+16);

		if (ctrl[0] < 0 \|\| ctrl[1] < 0) {
		printf("corrupt patch (negative byte counts)\n");
		return 1;
		}

		// Sanity check
		if (newpos + ctrl[0] > *new_size) {
		printf("corrupt patch (new file overrun)\n");