From 18a6ada4aa136da4f50f03fff91d61d448ced195 Mon Sep 17 00:00:00 2001 From: Ryan Mitchell Date: Wed, 30 May 2018 12:17:01 -0700 Subject: Fix DynamicRefTable::load security bug DynamicRefTables parsed from apks are missing bounds checks that prevent buffer overflows. This changes verifies the bounds of the header before attempting to preform operations on the chunk. Bug: 79488511 Test: run cts -m CtsAppSecurityHostTestCases \ -t android.appsecurity.cts.CorruptApkTests Change-Id: I02c8ad957da244fce777ac68a482e4e8fa70f846 Merged-In: I02c8ad957da244fce777ac68a482e4e8fa70f846 --- libs/androidfw/ResourceTypes.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp index 401c7b070188..2e77d8ca651d 100644 --- a/libs/androidfw/ResourceTypes.cpp +++ b/libs/androidfw/ResourceTypes.cpp @@ -6576,8 +6576,16 @@ status_t ResTable::parsePackage(const ResTable_package* const pkg, } } else if (ctype == RES_TABLE_LIBRARY_TYPE) { + if (group->dynamicRefTable.entries().size() == 0) { - status_t err = group->dynamicRefTable.load((const ResTable_lib_header*) chunk); + const ResTable_lib_header* lib = (const ResTable_lib_header*) chunk; + status_t err = validate_chunk(&lib->header, sizeof(*lib), + endPos, "ResTable_lib_header"); + if (err != NO_ERROR) { + return (mError=err); + } + + err = group->dynamicRefTable.load(lib); if (err != NO_ERROR) { return (mError=err); } -- cgit v1.2.3-59-g8ed1b