apps: aboot: Add check to prevent buffer overread in cmd_flash_mmc_img
Add check to confirm the size of given image is greater than BOOT_MAGIC_SIZE
which unchecked may cause OOB error while flashing boot/recovery images on
emmc targets.
Change-Id: I6e8c104641262e2d0c443294bb82af360c298972
Signed-off-by: Ashish Bhimanpalliwar <abhiman@codeaurora.org>
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index d2b04fd..16795e6 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -3734,7 +3734,7 @@
if (!strncmp(pname, "boot", strlen("boot"))
|| !strcmp(pname, "recovery"))
{
- if (memcmp((void *)data, BOOT_MAGIC, BOOT_MAGIC_SIZE)) {
+ if ((sz < BOOT_MAGIC_SIZE) || memcmp((void *)data, BOOT_MAGIC, BOOT_MAGIC_SIZE)) {
fastboot_fail("image is not a boot image");
return;
}