summaryrefslogtreecommitdiffstats
path: root/install/wipe_device.cpp
diff options
context:
space:
mode:
authorKelvin Zhang <zhangkelvin@google.com>2020-09-19 07:35:04 +0200
committerAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>2020-09-19 07:35:04 +0200
commit115a0172189a09e73bc010b377c8a68d8c6d3b8c (patch)
treef892e9ca467b4f751345a2a3200caf8903a217c9 /install/wipe_device.cpp
parentMerge "Merge mainline-release 6664920 to master - DO NOT MERGE" am: 7a899bb461 (diff)
parentMerge "Check for overflow before allocating memory fore decompression." (diff)
downloadandroid_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar.gz
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar.bz2
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar.lz
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar.xz
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.tar.zst
android_bootable_recovery-115a0172189a09e73bc010b377c8a68d8c6d3b8c.zip
Diffstat (limited to 'install/wipe_device.cpp')
-rw-r--r--install/wipe_device.cpp7
1 files changed, 6 insertions, 1 deletions
diff --git a/install/wipe_device.cpp b/install/wipe_device.cpp
index 0f896c43b..915c87b45 100644
--- a/install/wipe_device.cpp
+++ b/install/wipe_device.cpp
@@ -51,7 +51,12 @@ std::vector<std::string> GetWipePartitionList(Package* wipe_package) {
std::string partition_list_content;
ZipEntry64 entry;
if (FindEntry(zip, RECOVERY_WIPE_ENTRY_NAME, &entry) == 0) {
- uint32_t length = entry.uncompressed_length;
+ auto length = entry.uncompressed_length;
+ if (length > std::numeric_limits<size_t>::max()) {
+ LOG(ERROR) << "Failed to extract " << RECOVERY_WIPE_ENTRY_NAME
+ << " because's uncompressed size exceeds size of address space. " << length;
+ return {};
+ }
partition_list_content = std::string(length, '\0');
if (auto err = ExtractToMemory(
zip, &entry, reinterpret_cast<uint8_t*>(partition_list_content.data()), length);