| commit | fa5dd0b1f04fc53037a4bac4ce037e3984be122a | [log] [tgz] |
|---|---|---|
| author | Xin Li <delphij@google.com> | Tue Sep 08 16:53:57 2020 -0700 |
| committer | Xin Li <delphij@google.com> | Tue Sep 08 16:53:57 2020 -0700 |
| tree | 1252c9eeb76b56797b373a02e78ab1a190fd5339 | |
| parent | cd311c1dbee378c2d1711a09414c16e3b258a012 [diff] | |
| parent | 8491a425bc47375a8bf1450689bcab30db7343bc [diff] |
Merge Android R Bug: 168057903 Merged-In: Id72cfafe90e134554fab7d21fa0f94181d68e11d Change-Id: I45ada78019c2c86558c8941e915d01ed58f8e569
diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c index 1f451ca..222a616 100644 --- a/libavb/avb_descriptor.c +++ b/libavb/avb_descriptor.c
@@ -114,6 +114,10 @@ desc_end = desc_start + desc_size; for (p = desc_start; p < desc_end;) { + if (p + sizeof(AvbDescriptor) > desc_end) { + avb_error("Invalid descriptor length.\n"); + goto out; + } const AvbDescriptor* dh = (const AvbDescriptor*)p; uint64_t nb_following; uint64_t nb_total = 0;