diff options
| author | Kenny Root <kroot@google.com> | 2010-06-08 12:34:43 -0700 |
|---|---|---|
| committer | Alex Ray <aray@google.com> | 2013-07-30 13:56:53 -0700 |
| commit | ad4f2e59af9fe207056099dc002eb80cacbc0f4f (patch) | |
| tree | 598f6348ef56d0ee23b3f5af432fbf9a1e4017f1 /libs | |
| parent | 65d3c95a4d9a5fb4f61de952af0abd0db5380c77 (diff) | |
| download | system_core-ad4f2e59af9fe207056099dc002eb80cacbc0f4f.zip system_core-ad4f2e59af9fe207056099dc002eb80cacbc0f4f.tar.gz system_core-ad4f2e59af9fe207056099dc002eb80cacbc0f4f.tar.bz2 | |
Add invariant check for stylesString size
It was possible for stylesStrings to claim to start past the end of the
data area thereby making mStringPoolSize larger than the data area.
Change-Id: Ibc4d5b429e3a388516135801c8abc3681daae291
Diffstat (limited to 'libs')
| -rw-r--r-- | libs/utils/ResourceTypes.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libs/utils/ResourceTypes.cpp b/libs/utils/ResourceTypes.cpp index 954255b..4362d14 100644 --- a/libs/utils/ResourceTypes.cpp +++ b/libs/utils/ResourceTypes.cpp @@ -317,6 +317,12 @@ status_t ResStringPool::setTo(const void* data, size_t size, bool copyData) mStringPoolSize = (mHeader->header.size-mHeader->stringsStart)/charSize; } else { + // check invariant: styles starts before end of data + if (mHeader->stylesStart >= (mHeader->header.size-sizeof(uint16_t))) { + LOGW("Bad style block: style block starts at %d past data size of %d\n", + (int)mHeader->stylesStart, (int)mHeader->header.size); + return (mError=BAD_TYPE); + } // check invariant: styles follow the strings if (mHeader->stylesStart <= mHeader->stringsStart) { LOGW("Bad style block: style block starts at %d, before strings at %d\n", |