Improve authorization_set test coverage.
Change-Id: I8dd1830db8c19be07cef768c63c9ecfa3e16ae21
diff --git a/authorization_set.cpp b/authorization_set.cpp
index 61bfa6a..d147ef3 100644
--- a/authorization_set.cpp
+++ b/authorization_set.cpp
@@ -294,6 +294,13 @@
return false;
}
+ // Note that the following validation of elements_count is weak, but it prevents allocation of
+ // elems_ arrays which are clearly too large to be reasonable.
+ if (elements_size > end - *buf || elements_count * sizeof(uint32_t) > elements_size) {
+ set_invalid(MALFORMED_DATA);
+ return false;
+ }
+
elems_ = new keymaster_key_param_t[elements_count];
if (elems_ == NULL) {
set_invalid(ALLOCATION_FAILURE);