diff options
| author | Kelvin Zhang <zhangkelvin@google.com> | 2020-09-17 11:32:29 -0400 |
|---|---|---|
| committer | Kelvin Zhang <zhangkelvin@google.com> | 2020-09-18 17:41:51 -0400 |
| commit | d1ba38f7c96e74901779089fea6d09b0c7c2521d (patch) | |
| tree | f892e9ca467b4f751345a2a3200caf8903a217c9 /install/install.cpp | |
| parent | a35202befd6460a30330d57e7e69564bc6fb29f9 (diff) | |
Check for overflow before allocating memory fore decompression.
On 32bit devices, an ZipEntry64 may have size > 2^32, we should check
for such cases before attempting to allocate memory.
Test: mm -j
Change-Id: I0f916ef4b2a692f167719a74bd6ff2e887c6c2ce
Diffstat (limited to 'install/install.cpp')
| -rw-r--r-- | install/install.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/install/install.cpp b/install/install.cpp index 75337320..1b220cb3 100644 --- a/install/install.cpp +++ b/install/install.cpp @@ -246,7 +246,13 @@ bool SetUpAbUpdateCommands(const std::string& package, ZipArchiveHandle zip, int LOG(ERROR) << "Failed to find " << AB_OTA_PAYLOAD_PROPERTIES; return false; } - uint32_t properties_entry_length = properties_entry.uncompressed_length; + auto properties_entry_length = properties_entry.uncompressed_length; + if (properties_entry_length > std::numeric_limits<size_t>::max()) { + LOG(ERROR) << "Failed to extract " << AB_OTA_PAYLOAD_PROPERTIES + << " because's uncompressed size exceeds size of address space. " + << properties_entry_length; + return false; + } std::vector<uint8_t> payload_properties(properties_entry_length); int32_t err = ExtractToMemory(zip, &properties_entry, payload_properties.data(), properties_entry_length); |