diff options
| author | Adam Lesinski <adamlesinski@google.com> | 2014-05-14 11:43:26 -0700 |
|---|---|---|
| committer | Adam Lesinski <adamlesinski@google.com> | 2014-05-14 11:46:19 -0700 |
| commit | 7322ea7b73000ef50be18d72750624bb1832dec4 (patch) | |
| tree | eea527f69d30b56f3cdac404b8e4a2a68b7a655f /libs | |
| parent | da86f784b686ba00d9f797b8ee565629669080b9 (diff) | |
| download | frameworks_base-7322ea7b73000ef50be18d72750624bb1832dec4.zip frameworks_base-7322ea7b73000ef50be18d72750624bb1832dec4.tar.gz frameworks_base-7322ea7b73000ef50be18d72750624bb1832dec4.tar.bz2 | |
Fix potential crash in libandroidfw
A malformed APK may cause a crash if it
encodes its chunk size as a signed number
(MSB set to 1).
Bug:14898892
Change-Id: I342853c2b0859e5be15d712d451323afc367d329
Diffstat (limited to 'libs')
| -rw-r--r-- | libs/androidfw/ResourceTypes.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp index 6aad5fb..7d4da01 100644 --- a/libs/androidfw/ResourceTypes.cpp +++ b/libs/androidfw/ResourceTypes.cpp @@ -102,7 +102,7 @@ static status_t validate_chunk(const ResChunk_header* chunk, if (headerSize >= minSize) { if (headerSize <= size) { if (((headerSize|size)&0x3) == 0) { - if ((ssize_t)size <= (dataEnd-((const uint8_t*)chunk))) { + if ((size_t)size <= (size_t)(dataEnd-((const uint8_t*)chunk))) { return NO_ERROR; } ALOGW("%s data size 0x%x extends beyond resource end %p.", |