| commit | ea2dbf194aee956cd041039a66c0ce12a4148e0c | [log] [tgz] |
|---|---|---|
| author | David Zeuthen <zeuthen@google.com> | Tue Aug 25 15:16:22 2020 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Aug 25 15:16:22 2020 +0000 |
| tree | af338c6fe470f4ecf8d78cb1d28caf2edbb6bb9a | |
| parent | 18a15037dc990d527d89170342e71e9b81fadc44 [diff] | |
| parent | 66992bbe1443053afa73bd3d96d91388428e1e4e [diff] |
avb_str_concat: Fail if 0 is passed for buf_size. am: b73cea24f8 am: b5f275d3b5 am: 66992bbe14 Original change: https://googleplex-android-review.googlesource.com/c/platform/external/avb/+/10889377 Change-Id: I5f93e50e82e2e75509eca550697122ebad04574a
diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c index cfc2aac..7030a40 100644 --- a/libavb/avb_descriptor.c +++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@ } for (p = desc_start; p < desc_end;) { + if (p + sizeof(AvbDescriptor) > desc_end) { + avb_error("Invalid descriptor length.\n"); + goto out; + } const AvbDescriptor* dh = (const AvbDescriptor*)p; avb_assert_aligned(dh); uint64_t nb_following = avb_be64toh(dh->num_bytes_following);