commit 5a2b0ed1b6e360303642ee05e970373fb86ca253
author Nikita Ioffe <ioffe@google.com> Thu Apr 30 16:33:19 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Apr 30 16:33:19 2020 +0000
tree af338c6fe470f4ecf8d78cb1d28caf2edbb6bb9a
parent 66992bbe1443053afa73bd3d96d91388428e1e4e
parent b7fe9c3b204c94975335e38f3296b418c1ba9bb0

Check that there is enough space for AvbDescriptor am: 66872e8dc9 am: b7fe9c3b20

Change-Id: I1026408b77b9925fd94f1d785b3dc8ed121046ae

libavb/avb_descriptor.c

diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index cfc2aac..7030a40 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@
   }
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     avb_assert_aligned(dh);
     uint64_t nb_following = avb_be64toh(dh->num_bytes_following);