commit 8aff3316429191469552eea274c40817000578de
author Alex Legg <alexlegg@google.com> Mon May 11 05:14:51 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon May 11 05:14:51 2020 +0000
tree 02e0d3d99a11af5243ce5a93b1ea31d31e897b0d
parent f12682be79a0e985d7e94ee20e5f0e6815e83ce7
parent 6582ced668e97e7d8a6a76f4c29990c6aedee16a

Merge "Allow a make_vbmeta_image to use readonly argument" am: b52e368932 am: 6582ced668

Change-Id: Ib03b06e391dce180a776064025ce46a5500d17b8

libavb/avb_descriptor.c

diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index cfc2aac..7030a40 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@
   }
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     avb_assert_aligned(dh);
     uint64_t nb_following = avb_be64toh(dh->num_bytes_following);