diff options
| author | Kyeongkab.Nam <Kyeongkab.Nam@sony.com> | 2019-07-17 16:41:48 +0900 |
|---|---|---|
| committer | Kyeongkab.Nam <Kyeongkab.Nam@sony.com> | 2019-07-18 10:12:10 +0900 |
| commit | 35a8a11697af1ce018af1bee6fb494425c219514 (patch) | |
| tree | c795ddca4f25e70a5c2560c5818d69ecc7a8344c | |
| parent | d1379a4a80b5b45e6628ead5870080e91886b202 (diff) | |
Fix bootanimation stack overflow
length of input from scanf is not limited even though MAX char of path
is defined as 256. This could cause stack corruption when length of input
is over MAX.
Test: run bootanimation with desc.txt which has over 256 length of path.
Change-Id: Ic60081ca82067ad671508e766c495546af9233d1
| -rw-r--r-- | cmds/bootanimation/BootAnimation.cpp | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/cmds/bootanimation/BootAnimation.cpp b/cmds/bootanimation/BootAnimation.cpp index ed6c25dc49c3..95bdc4a79af9 100644 --- a/cmds/bootanimation/BootAnimation.cpp +++ b/cmds/bootanimation/BootAnimation.cpp @@ -63,6 +63,10 @@ #include "BootAnimation.h" +#define ANIM_PATH_MAX 255 +#define STR(x) #x +#define STRTO(x) STR(x) + namespace android { static const char OEM_BOOTANIMATION_FILE[] = "/oem/media/bootanimation.zip"; @@ -94,7 +98,7 @@ static constexpr size_t FONT_NUM_ROWS = FONT_NUM_CHARS / FONT_NUM_COLS; static const int TEXT_CENTER_VALUE = INT_MAX; static const int TEXT_MISSING_VALUE = INT_MIN; static const char EXIT_PROP_NAME[] = "service.bootanim.exit"; -static const int ANIM_ENTRY_NAME_MAX = 256; +static const int ANIM_ENTRY_NAME_MAX = ANIM_PATH_MAX + 1; static constexpr size_t TEXT_POS_LEN_MAX = 16; // --------------------------------------------------------------------------- @@ -658,7 +662,7 @@ bool BootAnimation::parseAnimationDesc(Animation& animation) animation.width = width; animation.height = height; animation.fps = fps; - } else if (sscanf(l, " %c %d %d %s #%6s %16s %16s", + } else if (sscanf(l, " %c %d %d %" STRTO(ANIM_PATH_MAX) "s #%6s %16s %16s", &pathType, &count, &pause, path, color, clockPos1, clockPos2) >= 4) { //ALOGD("> type=%c, count=%d, pause=%d, path=%s, color=%s, clockPos1=%s, clockPos2=%s", // pathType, count, pause, path, color, clockPos1, clockPos2); |