diff options
| author | Kelvin Zhang <zhangkelvin@google.com> | 2020-09-19 02:51:22 +0200 |
|---|---|---|
| committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2020-09-19 02:51:22 +0200 |
| commit | c1d2c15785043f5b45082d005d753e830ce602f0 (patch) | |
| tree | f892e9ca467b4f751345a2a3200caf8903a217c9 /updater/install.cpp | |
| parent | Merge "Merge mainline-release 6664920 to master - DO NOT MERGE" (diff) | |
| parent | Check for overflow before allocating memory fore decompression. (diff) | |
| download | android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar.gz android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar.bz2 android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar.lz android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar.xz android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.tar.zst android_bootable_recovery-c1d2c15785043f5b45082d005d753e830ce602f0.zip | |
Diffstat (limited to '')
| -rw-r--r-- | updater/install.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/updater/install.cpp b/updater/install.cpp index cfa4d9d82..295965047 100644 --- a/updater/install.cpp +++ b/updater/install.cpp @@ -35,6 +35,7 @@ #include <unistd.h> #include <utime.h> +#include <limits> #include <memory> #include <string> #include <vector> @@ -172,6 +173,11 @@ Value* PackageExtractFileFn(const char* name, State* state, } std::string buffer; + if (entry.uncompressed_length > std::numeric_limits<size_t>::max()) { + return ErrorAbort(state, kPackageExtractFileFailure, + "%s(): Entry `%s` Uncompressed size exceeds size of address space.", name, + zip_path.c_str()); + } buffer.resize(entry.uncompressed_length); int32_t ret = |