commit c26b8635b70c4b36e614e10aeb8cfbe7fc1f3243
author Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jan 17 22:20:46 2018 +0000
committer Android Build Merger (Role) <noreply-android-build-merger@google.com> Wed Jan 17 22:20:46 2018 +0000
tree 392a9c083f5c3ba5358ea66cebed9398fe885aca
parent 49dfdd66cc29266cf58ea834c244510aa33bce8e
parent b7f7f7e14e6f1dfa3feb64af04fd831d7b00e3e4

[automerger] Check for null-terminator in ResStringPool::string8At am: 5ec65ae909 am: c3d7250b99 am: e2417e6682 am: 0ab4540c41 am: a3f0976937 am: 166aa6e149 am: b7f7f7e14e

Change-Id: I24714505cc04c722b7d49762ee3e965369fd4d1e

libs/androidfw/ResourceTypes.cpp

diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp
index ceeb12b..7cb4216 100644
--- a/libs/androidfw/ResourceTypes.cpp
+++ b/libs/androidfw/ResourceTypes.cpp
@@ -807,7 +807,13 @@
             *outLen = decodeLength(&str);
             size_t encLen = decodeLength(&str);
             if ((uint32_t)(str+encLen-strings) < mStringPoolSize) {
-                return (const char*)str;
+                // Reject malformed (non null-terminated) strings
+                if (str[encLen] != 0x00) {
+                    ALOGW("Bad string block: string #%d is not null-terminated",
+                          (int)idx);
+                    return NULL;
+                }
+              return (const char*)str;
             } else {
                 ALOGW("Bad string block: string #%d extends to %d, past end at %d\n",
                         (int)idx, (int)(str+encLen-strings), (int)mStringPoolSize);