commit aeb2fc64d92594b43e0aa0abf12699235bb24ed9
author Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jun 06 17:12:11 2018 +0000
committer Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jun 06 17:12:11 2018 +0000
tree 284ecc0f85bfe9c4f1057e0c6f84238859b82a3c
parent eb86ac42e6c4ccc6c0615758abba5ef3ce4c746e
parent d65dbf91ce12c85a302d7cce7922d3a7ba7f7580

[automerger] Fix DynamicRefTable::load security bug am: 8cf0f988b0 am: d65dbf91ce

Change-Id: I17fcbac2b6a7860749ddaabf6324cd89e3b78570

libs/androidfw/ResourceTypes.cpp

diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp
index 9941e46..0ea0652 100644
--- a/libs/androidfw/ResourceTypes.cpp
+++ b/libs/androidfw/ResourceTypes.cpp
@@ -6220,8 +6220,16 @@
             }
 
         } else if (ctype == RES_TABLE_LIBRARY_TYPE) {
+
             if (group->dynamicRefTable.entries().size() == 0) {
-                status_t err = group->dynamicRefTable.load((const ResTable_lib_header*) chunk);
+                const ResTable_lib_header* lib = (const ResTable_lib_header*) chunk;
+                status_t err = validate_chunk(&lib->header, sizeof(*lib),
+                                              endPos, "ResTable_lib_header");
+                if (err != NO_ERROR) {
+                    return (mError=err);
+                }
+
+                err = group->dynamicRefTable.load(lib);
                 if (err != NO_ERROR) {
                     return (mError=err);
                 }