commit | e1de2d96fd0fe1b2f5f69bdff58c4897c7b36ff9 | [log] [tgz] |
---|---|---|
author | ThiƩbaud Weksteen <tweek@google.com> | Mon May 11 07:47:10 2020 +0000 |
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Mon May 11 07:47:10 2020 +0000 |
tree | aab45e2095e519e4eb1811306761d6c2a5eb8d77 | |
parent | 8aff3316429191469552eea274c40817000578de [diff] | |
parent | 1924fe31809915a356299ba1333d4f85bff23491 [diff] |
Merge changes If4e90a6e,Ie23639f6,Iccb473a4 am: b27a9aa53d am: 1924fe3180 Change-Id: I079c1ef7867745b663347b51261f1c0ebf6177b5
diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c index cfc2aac..7030a40 100644 --- a/libavb/avb_descriptor.c +++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@ } for (p = desc_start; p < desc_end;) { + if (p + sizeof(AvbDescriptor) > desc_end) { + avb_error("Invalid descriptor length.\n"); + goto out; + } const AvbDescriptor* dh = (const AvbDescriptor*)p; avb_assert_aligned(dh); uint64_t nb_following = avb_be64toh(dh->num_bytes_following);