commit a7a95a43ac2310a5dcec53e65bbd2db6c2437a1c
author Varun Sharma <vars@google.com> Wed May 06 00:22:45 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed May 06 00:22:45 2020 +0000
tree e836e4e80bea6e242dcdf3f78ded85297a6e8afa
parent 91148aaedd2dbd197d844e268862e109b757628d
parent 65f006b17e9b4c578b726478c9f9165ca5a8f76b

Merge "Fix preload partition failure behavior" am: 6259714f90 am: 65f006b17e

Change-Id: Id6615a9cd60aeab9cf7871f0f3e8906320d35424

libavb/avb_descriptor.c

diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index cfc2aac..7030a40 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@
   }
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     avb_assert_aligned(dh);
     uint64_t nb_following = avb_be64toh(dh->num_bytes_following);