summaryrefslogtreecommitdiffstats
path: root/updater/updater.cpp
diff options
context:
space:
mode:
authorKelvin Zhang <zhangkelvin@google.com>2020-09-19 10:58:59 +0200
committerAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>2020-09-19 10:58:59 +0200
commit6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73 (patch)
tree6a1b77b1e1a62e27ea23f0940266b7557dec8382 /updater/updater.cpp
parent[automerger skipped] Merge "Merge mainline-release 6664920 to master - DO NOT MERGE" am: 7a899bb461 am: d3865b7a63 -s ours am: c4eabe78c5 -s ours am: c00dfe5d95 -s ours (diff)
parentMerge "Check for overflow before allocating memory fore decompression." am: c1d2c15785 am: 115a017218 am: 701b8d660d (diff)
downloadandroid_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar.gz
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar.bz2
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar.lz
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar.xz
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.tar.zst
android_bootable_recovery-6e970758e117c38ab8c6b3db7ba6d5ed69fb7c73.zip
Diffstat (limited to 'updater/updater.cpp')
-rw-r--r--updater/updater.cpp7
1 files changed, 6 insertions, 1 deletions
diff --git a/updater/updater.cpp b/updater/updater.cpp
index 73ca0e532..c52673462 100644
--- a/updater/updater.cpp
+++ b/updater/updater.cpp
@@ -170,7 +170,12 @@ bool Updater::ReadEntryToString(ZipArchiveHandle za, const std::string& entry_na
<< " in the package: " << ErrorCodeString(find_err);
return false;
}
-
+ if (entry.uncompressed_length > std::numeric_limits<size_t>::max()) {
+ LOG(ERROR) << "Failed to extract " << entry_name
+ << " because's uncompressed size exceeds size of address space. "
+ << entry.uncompressed_length;
+ return false;
+ }
content->resize(entry.uncompressed_length);
int extract_err = ExtractToMemory(za, &entry, reinterpret_cast<uint8_t*>(&content->at(0)),
entry.uncompressed_length);