Merge branch 'cm-13.0' of https://github.com/LineageOS/android_bootable_recovery into replicant-6.0replicant-6.0-0001

2 files changed, 10 insertions, 4 deletions

diff --git a/ui.cpp b/ui.cpp
index d1eca91..c7268fb 100644
--- a/ui.cpp
+++ b/ui.cpp
@@ -444,12 +444,12 @@ void RecoveryUI::ProcessRel(input_device* dev, int code, int value) {
         // key event.
         dev->rel_sum += value;
         if (dev->rel_sum > 3) {
-            process_key(dev, KEY_DOWN, 1);   // press down key
-            process_key(dev, KEY_DOWN, 0);   // and release it
+            ProcessKey(dev, KEY_DOWN, 1);   // press down key
+            ProcessKey(dev, KEY_DOWN, 0);   // and release it
             dev->rel_sum = 0;
         } else if (dev->rel_sum < -3) {
-            process_key(dev, KEY_UP, 1);     // press up key
-            process_key(dev, KEY_UP, 0);     // and release it
+            ProcessKey(dev, KEY_UP, 1);     // press up key
+            ProcessKey(dev, KEY_UP, 0);     // and release it
             dev->rel_sum = 0;
         }
     }
diff --git a/verifier.cpp b/verifier.cpp
index 61e5adf..bf7071d 100644
--- a/verifier.cpp
+++ b/verifier.cpp
@@ -144,6 +144,12 @@ int verify_file(unsigned char* addr, size_t length,
     LOGI("comment is %zu bytes; signature %zu bytes from end\n",
          comment_size, signature_start);
 
+    if (signature_start > comment_size) {
+        LOGE("signature start: %zu is larger than comment size: %zu\n", signature_start,
+             comment_size);
+        return VERIFY_FAILURE;
+    }
+
     if (signature_start <= FOOTER_SIZE) {
         LOGE("Signature start is in the footer");
         return VERIFY_FAILURE;