platform: msm_shared: Remove NULL access in string comparison
Use strncmp instead of strcmp to remove NULL access
for the second string in case length of first string
is greater than the second string.
Change-Id: I7fb70f14a1a33037f0a6d3c6d102f5c1722244d3
diff --git a/platform/msm_shared/avb/libavb/avb_slot_verify.c b/platform/msm_shared/avb/libavb/avb_slot_verify.c
index d70a147..2b9b7be 100644
--- a/platform/msm_shared/avb/libavb/avb_slot_verify.c
+++ b/platform/msm_shared/avb/libavb/avb_slot_verify.c
@@ -175,7 +175,8 @@
goto out;
}
- if (avb_strcmp((const char*)hash_desc.hash_algorithm, "sha256") == 0) {
+ if (avb_strncmp((const char*)hash_desc.hash_algorithm, "sha256",
+ avb_strlen ("sha256")) == 0) {
uint32_t complete_len = hash_desc.salt_len + hash_desc.image_size;
digest = avb_malloc(AVB_SHA256_DIGEST_SIZE);
if(digest == NULL || hash_desc.salt_len > SALT_BUFF_OFFSET )
@@ -189,7 +190,8 @@
hash_find(image_buf, complete_len, digest, CRYPTO_AUTH_ALG_SHA256);
image_buf = SUB_SALT_BUFF_OFFSET(image_buf) + hash_desc.salt_len;
digest_len = AVB_SHA256_DIGEST_SIZE;
- } else if (avb_strcmp((const char*)hash_desc.hash_algorithm, "sha512") == 0) {
+ } else if (avb_strncmp((const char*)hash_desc.hash_algorithm, "sha512",
+ avb_strlen ("sha512")) == 0) {
AvbSHA512Ctx sha512_ctx;
uint8_t *dig;
digest = avb_malloc(AVB_SHA512_DIGEST_SIZE);
diff --git a/platform/msm_shared/avb/libavb/avb_sysdeps.h b/platform/msm_shared/avb/libavb/avb_sysdeps.h
index 55e3e19..6ed7d4f 100644
--- a/platform/msm_shared/avb/libavb/avb_sysdeps.h
+++ b/platform/msm_shared/avb/libavb/avb_sysdeps.h
@@ -75,6 +75,14 @@
*/
int avb_strcmp(const char* s1, const char* s2);
+/* Compare |n| bytes in two strings.
+ *
+ * Return an integer less than, equal to, or greater than zero if the
+ * first |n| bytes of |s1| is found, respectively, to be less than,
+ * to match, or be greater than the first |n| bytes of |s2|.
+ */
+int avb_strncmp(const char* s1, const char* s2, size_t n);
+
/* Copy |n| bytes from |src| to |dest|. */
void* avb_memcpy(void* dest, const void* src, size_t n);
diff --git a/platform/msm_shared/avb/libavb/avb_sysdeps_posix.c b/platform/msm_shared/avb/libavb/avb_sysdeps_posix.c
index dfbfc39..a155ac6 100644
--- a/platform/msm_shared/avb/libavb/avb_sysdeps_posix.c
+++ b/platform/msm_shared/avb/libavb/avb_sysdeps_posix.c
@@ -46,6 +46,10 @@
return strcmp(s1, s2);
}
+int avb_strncmp(const char* s1, const char* s2, size_t n) {
+ return strncmp(s1, s2, n);
+}
+
size_t avb_strlen(const char* str) {
return strlen(str);
}