| commit | 8da1c38b69e947885fcec50cda46c5472ddb6746 | [log] [tgz] |
|---|---|---|
| author | Ryan Mitchell <rtmitchell@google.com> | Fri Aug 23 11:45:04 2019 -0700 |
| committer | Ryan Mitchell <rtmitchell@google.com> | Fri Aug 23 13:11:14 2019 -0700 |
| tree | 0bde6149b1b989b27aaf97a83703b5775ba83c9a | |
| parent | 3dc631cfc9b08b385f2f11b072b314cce0f8bdb3 [diff] |
Fix security issue in DynamicRefTable::load. A crafted resources arsc could cause libandroidfw to read data out of bounds of the resources arsc. This change updates the logic to calculate whether the ref table chunk is large enough to hold the number of entries specified in the header. Bug: 129475100 Test: adb shell push ResTableTest data Test: adb shell push poc.arsc data Test: ./ResTableTest poc.arsc Change-Id: Ifbaad87bdbcb7eecf554ef362e0118f53532a22a