commit 3f1562247502ce0f31f64aeeb6c05243e8928a2c
author Linux Build Service Account <lnxbuild@localhost> Mon Sep 24 08:50:50 2018 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Sep 24 08:50:50 2018 -0700
tree b4053c87eb8931fbaf3baa6f52e395b3e7cc7ebf
parent b7302b99738d073774ed331b9a262b51248342de
parent a1a83c7a80e35ba82763c6b258fe614138fde20d

Merge "app: aboot: Change to round recovery dtbo size to page size."

platform/msm_shared/avb/libavb/avb_slot_verify.c

diff --git a/platform/msm_shared/avb/libavb/avb_slot_verify.c b/platform/msm_shared/avb/libavb/avb_slot_verify.c
index ac17e93..42ee9be 100644
--- a/platform/msm_shared/avb/libavb/avb_slot_verify.c
+++ b/platform/msm_shared/avb/libavb/avb_slot_verify.c
@@ -716,6 +716,11 @@
    */
   descriptors =
       avb_descriptor_get_all(vbmeta_buf, vbmeta_num_read, &num_descriptors);
+  if (descriptors == NULL) {
+    ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
+    goto out;
+  }
+
   for (n = 0; n < num_descriptors; n++) {
     AvbDescriptor desc;
 

platform/msm_shared/avb/libavb/avb_util.c

diff --git a/platform/msm_shared/avb/libavb/avb_util.c b/platform/msm_shared/avb/libavb/avb_util.c
index 43662b4..09b05f1 100644
--- a/platform/msm_shared/avb/libavb/avb_util.c
+++ b/platform/msm_shared/avb/libavb/avb_util.c
@@ -299,9 +299,8 @@
       char* new_str;
       num_new = ret_len + num_before + replace_len + 1;
       new_str = avb_malloc(num_new);
-      if (ret == NULL) {
+      if (new_str == NULL)
         goto out;
-      }
       avb_memcpy(new_str, ret, ret_len);
       avb_memcpy(new_str + ret_len, str, num_before);
       avb_memcpy(new_str + ret_len + num_before, replace, replace_len);
@@ -324,9 +323,8 @@
     size_t num_remaining = avb_strlen(str_after_last_replace);
     size_t num_new = ret_len + num_remaining + 1;
     char* new_str = avb_malloc(num_new);
-    if (ret == NULL) {
+    if (new_str == NULL)
       goto out;
-    }
     avb_memcpy(new_str, ret, ret_len);
     avb_memcpy(new_str + ret_len, str_after_last_replace, num_remaining);
     new_str[num_new - 1] = '\0';