commit 433f65b2f7199a7d9c75096f968ea50701359e1c
author Thiébaud Weksteen <tweek@google.com> Fri May 15 11:19:34 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Fri May 15 11:19:34 2020 +0000
tree 9b2011c3bc1240b2c2cb672bf4c17ef9ee043fcd
parent b6ba478fdda7e65a6d825e45ce0728758a608359
parent 7e07772b01bb8e0ef466f0e360cb422e06a4792b

Merge "libavb_aftl: use read_mem in log root parser" am: 916495b842 am: 7e07772b01

Change-Id: I3d7adbb77c67c1ad5be42378056fd9a3ddec4bfe

libavb/avb_descriptor.c

diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index cfc2aac..7030a40 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@
   }
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     avb_assert_aligned(dh);
     uint64_t nb_following = avb_be64toh(dh->num_bytes_following);