| Révision | 906afb4f3641963583a4334bd8291d479b8c844a (tree) |
|---|---|
| l'heure | 2018-08-11 05:28:02 |
| Auteur | Ryan Mitchell <rtmitchell@goog...> |
| Commiter | android-build-team Robot |
Fix DynamicRefTable::load security bug
DynamicRefTables parsed from apks are missing bounds checks that prevent
buffer overflows. This changes verifies the bounds of the header before
attempting to preform operations on the chunk.
Bug: 79488511
Test: run cts -m CtsAppSecurityHostTestCases \
Change-Id: I02c8ad957da244fce777ac68a482e4e8fa70f846
Merged-In: I02c8ad957da244fce777ac68a482e4e8fa70f846
(cherry picked from commit 18a6ada4aa136da4f50f03fff91d61d448ced195)
libs/androidfw/ResourceTypes.cpp (diff)| @@ -6576,8 +6576,16 @@ status_t ResTable::parsePackage(const ResTable_package* const pkg, | ||
| 6576 | 6576 | } |
| 6577 | 6577 | |
| 6578 | 6578 | } else if (ctype == RES_TABLE_LIBRARY_TYPE) { |
| 6579 | + | |
| 6579 | 6580 | if (group->dynamicRefTable.entries().size() == 0) { |
| 6580 | - status_t err = group->dynamicRefTable.load((const ResTable_lib_header*) chunk); | |
| 6581 | + const ResTable_lib_header* lib = (const ResTable_lib_header*) chunk; | |
| 6582 | + status_t err = validate_chunk(&lib->header, sizeof(*lib), | |
| 6583 | + endPos, "ResTable_lib_header"); | |
| 6584 | + if (err != NO_ERROR) { | |
| 6585 | + return (mError=err); | |
| 6586 | + } | |
| 6587 | + | |
| 6588 | + err = group->dynamicRefTable.load(lib); | |
| 6581 | 6589 | if (err != NO_ERROR) { |
| 6582 | 6590 | return (mError=err); |
| 6583 | 6591 | } |
Android-x86
Fork