Commit: 4d4f8b30b850a3e15638c28aabef7b0f3aedeb8c - system-core (git)

system/core

Commit MetaInfo

• Révision: 4d4f8b30b850a3e15638c28aabef7b0f3aedeb8c (tree)
• l'heure: 2018-01-04 17:45:08
• Auteur: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Message de Log

Android 7.1.2 Release 36 (N2G48H)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCWicTpAAKCRDorT+BmrEO
eDIiAJ9+Hiu7GqFVtyOM5DwPNS4Sx+s1VACfdruL1q6Yk9+QYV0/kSyxoEV/5Gg=
=u9qR
-----END PGP SIGNATURE-----

Merge tag 'android-7.1.2_r36' into nougat-x86

Android 7.1.2 Release 36 (N2G48H)

Change Summary

• modified: libutils/Unicode.cpp
• modified: libziparchive/zip_archive.cc
• modified: libziparchive/zip_archive_test.cc

Modification

--- a/libutils/Unicode.cpp
+++ b/libutils/Unicode.cpp
@@ -18,6 +18,7 @@
 #include <utils/Unicode.h>
 
 #include <stddef.h>
+#include <limits.h>
 
 #if defined(_WIN32)
 # undef  nhtol
@@ -178,7 +179,15 @@ ssize_t utf32_to_utf8_length(const char32_t *src, size_t src_len)
     size_t ret = 0;
     const char32_t *end = src + src_len;
     while (src < end) {
-        ret += utf32_codepoint_utf8_length(*src++);
+        size_t char_len = utf32_codepoint_utf8_length(*src++);
+        if (SSIZE_MAX - char_len < ret) {
+            // If this happens, we would overflow the ssize_t type when
+            // returning from this function, so we cannot express how
+            // long this string is in an ssize_t.
+            android_errorWriteLog(0x534e4554, "37723026");
+            return -1;
+        }
+        ret += char_len;
     }
     return ret;
 }
@@ -438,14 +447,23 @@ ssize_t utf16_to_utf8_length(const char16_t *src, size_t src_len)
     size_t ret = 0;
     const char16_t* const end = src + src_len;
     while (src < end) {
+        size_t char_len;
         if ((*src & 0xFC00) == 0xD800 && (src + 1) < end
                 && (*(src + 1) & 0xFC00) == 0xDC00) {
             // surrogate pairs are always 4 bytes.
-            ret += 4;
+            char_len = 4;
             src += 2;
         } else {
-            ret += utf32_codepoint_utf8_length((char32_t) *src++);
+            char_len = utf32_codepoint_utf8_length((char32_t)*src++);
+        }
+        if (SSIZE_MAX - char_len < ret) {
+            // If this happens, we would overflow the ssize_t type when
+            // returning from this function, so we cannot express how
+            // long this string is in an ssize_t.
+            android_errorWriteLog(0x534e4554, "37723026");
+            return -1;
         }
+        ret += char_len;
     }
     return ret;
 }

--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -358,6 +358,8 @@ static int32_t MapCentralDirectory(int fd, const char* debug_file_name,
   return result;
 }
 
+static inline bool ReadAtOffset(int fd, uint8_t* buf, size_t len, off64_t off);
+
 /*
  * Parses the Zip archive's Central Directory.  Allocates and populates the
  * hash table.
@@ -436,6 +438,22 @@ static int32_t ParseZipArchive(ZipArchive* archive) {
       return -1;
     }
   }
+
+  uint32_t lfh_start_bytes;
+  if (!ReadAtOffset(archive->fd, reinterpret_cast<uint8_t*>(&lfh_start_bytes),
+                    sizeof(uint32_t), 0)) {
+    ALOGW("Zip: Unable to read header for entry at offset == 0.");
+    return -1;
+  }
+
+  if (lfh_start_bytes != LocalFileHeader::kSignature) {
+    ALOGW("Zip: Entry at offset zero has invalid LFH signature %" PRIx32, lfh_start_bytes);
+#if defined(__ANDROID__)
+    android_errorWriteLog(0x534e4554, "64211847");
+#endif
+    return -1;
+  }
+
   ALOGV("+++ zip good scan %" PRIu16 " entries", num_entries);
 
   return 0;

--- a/libziparchive/zip_archive_test.cc
+++ b/libziparchive/zip_archive_test.cc
@@ -603,6 +603,55 @@ TEST(ziparchive, StreamUncompressedBadCrc) {
   CloseArchive(handle);
 }
 
+// A zip file whose local file header at offset zero is corrupted.
+//
+// ---------------
+// cat foo > a.txt
+// zip a.zip a.txt
+// cat a.zip | xxd -i
+//
+// Manual changes :
+// [2] = 0xff  // Corrupt the LFH signature of entry 0.
+// [3] = 0xff  // Corrupt the LFH signature of entry 0.
+static const std::vector<uint8_t> kZipFileWithBrokenLfhSignature{
+    //[lfh-sig-----------], [lfh contents---------------------------------
+    0x50, 0x4b, 0xff, 0xff, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x80,
+    //--------------------------------------------------------------------
+    0x09, 0x4b, 0xa8, 0x65, 0x32, 0x7e, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00,
+    //-------------------------------]  [file-name-----------------], [---
+    0x00, 0x00, 0x05, 0x00, 0x1c, 0x00, 0x61, 0x2e, 0x74, 0x78, 0x74, 0x55,
+    // entry-contents------------------------------------------------------
+    0x54, 0x09, 0x00, 0x03, 0x51, 0x24, 0x8b, 0x59, 0x51, 0x24, 0x8b, 0x59,
+    //--------------------------------------------------------------------
+    0x75, 0x78, 0x0b, 0x00, 0x01, 0x04, 0x89, 0x42, 0x00, 0x00, 0x04, 0x88,
+    //-------------------------------------], [cd-record-sig-------], [---
+    0x13, 0x00, 0x00, 0x66, 0x6f, 0x6f, 0x0a, 0x50, 0x4b, 0x01, 0x02, 0x1e,
+    // cd-record-----------------------------------------------------------
+    0x03, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x80, 0x09, 0x4b, 0xa8,
+    //--------------------------------------------------------------------
+    0x65, 0x32, 0x7e, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05,
+    //--------------------------------------------------------------------
+    0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa0,
+    //-]  [lfh-file-header-off-], [file-name-----------------], [extra----
+    0x81, 0x00, 0x00, 0x00, 0x00, 0x61, 0x2e, 0x74, 0x78, 0x74, 0x55, 0x54,
+    //--------------------------------------------------------------------
+    0x05, 0x00, 0x03, 0x51, 0x24, 0x8b, 0x59, 0x75, 0x78, 0x0b, 0x00, 0x01,
+    //-------------------------------------------------------], [eocd-sig-
+    0x04, 0x89, 0x42, 0x00, 0x00, 0x04, 0x88, 0x13, 0x00, 0x00, 0x50, 0x4b,
+    //-------], [---------------------------------------------------------
+    0x05, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x4b, 0x00,
+    //-------------------------------------------]
+    0x00, 0x00, 0x43, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+TEST(ziparchive, BrokenLfhSignature) {
+  TemporaryFile tmp_file;
+  ASSERT_NE(-1, tmp_file.fd);
+  ASSERT_TRUE(android::base::WriteFully(tmp_file.fd, &kZipFileWithBrokenLfhSignature[0],
+                                        kZipFileWithBrokenLfhSignature.size()));
+  ZipArchiveHandle handle;
+  ASSERT_EQ(-1, OpenArchiveFd(tmp_file.fd, "LeadingNonZipBytes", &handle));
+}
+
 int main(int argc, char** argv) {
   ::testing::InitGoogleTest(&argc, argv);