commit b39e49d52c8a78dd8cdb5ee94111faac55ab311f
author Android Build Merger (Role) <noreply-android-build-merger@google.com> Thu Feb 01 03:13:16 2018 +0000
committer android-build-merger <android-build-merger@google.com> Thu Feb 01 03:13:16 2018 +0000
tree a3653c0ca7ea16193562be9993e251704878495e
parent df255a4a6b3dfbde4a8fc16279faa5d998f8eb6d
parent 46fc48f57ea754372d5304a5903acf28b8d0d2c3

Merge changes from topic "am-1ab9514f-fd12-4093-b1cb-a77e9f0419c9" into oc-dev
am: 46fc48f57e

Change-Id: I85ba0993926fbd9a61525e35e411887130b3c5aa

libs/androidfw/ResourceTypes.cpp

diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp
index bab8883..1798d66 100644
--- a/libs/androidfw/ResourceTypes.cpp
+++ b/libs/androidfw/ResourceTypes.cpp
@@ -813,7 +813,13 @@
             *outLen = encLen;
 
             if ((uint32_t)(str+encLen-strings) < mStringPoolSize) {
-                return (const char*)str;
+                // Reject malformed (non null-terminated) strings
+                if (str[encLen] != 0x00) {
+                    ALOGW("Bad string block: string #%d is not null-terminated",
+                          (int)idx);
+                    return NULL;
+                }
+              return (const char*)str;
             } else {
                 ALOGW("Bad string block: string #%d extends to %d, past end at %d\n",
                         (int)idx, (int)(str+encLen-strings), (int)mStringPoolSize);