summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDoug Zongker <dougz@google.com>2014-05-16 17:09:35 +0200
committerAndroid Git Automerger <android-git-automerger@android.com>2014-05-16 17:09:35 +0200
commitddb1b744983e37b51fc20759bbf8dac31f4d30ad (patch)
tree02e2420d49536bf886ea14256bd087ada49592e4
parentam 0766cdf4: am d2fb4ed5: am d27aa76a: Merge "Support BGRA framebuffer" (diff)
parentam d4592694: am 3ca99f6c: Merge "fix vulnerability in bspatch" (diff)
downloadandroid_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar.gz
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar.bz2
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar.lz
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar.xz
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.tar.zst
android_bootable_recovery-ddb1b744983e37b51fc20759bbf8dac31f4d30ad.zip
Diffstat (limited to '')
-rw-r--r--applypatch/bspatch.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/applypatch/bspatch.c b/applypatch/bspatch.c
index 2e80f81d0..1dc7ab10b 100644
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.c
@@ -205,6 +205,11 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
ctrl[1] = offtin(buf+8);
ctrl[2] = offtin(buf+16);
+ if (ctrl[0] < 0 || ctrl[1] < 0) {
+ printf("corrupt patch (negative byte counts)\n");
+ return 1;
+ }
+
// Sanity check
if (newpos + ctrl[0] > *new_size) {
printf("corrupt patch (new file overrun)\n");