diff options
| author | Tianjie Xu <xunchang@google.com> | 2018-09-07 15:24:58 -0700 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-03-05 15:16:55 +0100 |
| commit | 6daf4c501645fe2a80bcd2e6d34904fa124001b1 (patch) | |
| tree | 74ff923fded3745d53e9729c2a40fc42403414aa | |
| parent | a8cf70c8b06eadebe2ecc74ad01221f3c9023c0c (diff) | |
| download | android_bootable_recovery-cm-11.0.tar.gz android_bootable_recovery-cm-11.0.tar.bz2 android_bootable_recovery-cm-11.0.zip | |
DO NOT MERGE: Initialize the ZipArchive to zero before parsingcm-11.0
The fields of the ZipArchive on the stack are not initialized before we
call libminzip to parse the zip file. As a result, some random memory
location is freed unintentionally when we close the ZipArchive upon
parsing failures.
Bug: 35385357
Test: recompile and run the poc with asan.
Change-Id: I7e7f8ab4816c84a158af7389e1a889f8fc65f079
| -rw-r--r-- | install.c | 2 | ||||
| -rw-r--r-- | updater/updater.c | 2 |
2 files changed, 2 insertions, 2 deletions
@@ -439,7 +439,7 @@ really_install_package(const char *path) /* Try to open the package. */ - ZipArchive zip; + ZipArchive zip = {}; err = mzOpenZipArchive(path, &zip); if (err != 0) { LOGE("Can't open %s\n(%s)\n", path, err != -1 ? strerror(err) : "bad"); diff --git a/updater/updater.c b/updater/updater.c index bf665cab..33b51d3c 100644 --- a/updater/updater.c +++ b/updater/updater.c @@ -65,7 +65,7 @@ int main(int argc, char** argv) { // Extract the script from the package. char* package_data = argv[3]; - ZipArchive za; + ZipArchive za = {}; int err; err = mzOpenZipArchive(package_data, &za); if (err != 0) { |