commit 05ca686d8714bf2aa5b9f275218ff3f188228cc5
author android-build-team Robot <android-build-team-robot@google.com> Fri May 01 07:00:36 2020 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Fri May 01 07:00:36 2020 +0000
tree af338c6fe470f4ecf8d78cb1d28caf2edbb6bb9a
parent 7d4aa922f2d41d7ac0b4f8b9c96a93158e82c3e5
parent 2dc2ef8e5928027e9b9dcf0bb7bd59b45a214276

Snap for 6450912 from 2dc2ef8e5928027e9b9dcf0bb7bd59b45a214276 to mainline-release

Change-Id: If078e2a73e6dd5b827dc0bcf6b3e494afeae63e9

libavb/avb_descriptor.c

diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index cfc2aac..7030a40 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -88,6 +88,10 @@
   }
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     avb_assert_aligned(dh);
     uint64_t nb_following = avb_be64toh(dh->num_bytes_following);