diff options
| author | Tianjie Xu <xunchang@google.com> | 2018-09-07 15:24:58 -0700 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-03-05 15:50:49 +0100 |
| commit | d488704fd1499f5c2ec579e16e48c14f14314b4a (patch) | |
| tree | f675fa732229e8b294c9c84c8da868a00e893f88 | |
| parent | 2baec0b0feba6c74722cc07dee3e739298e64db5 (diff) | |
| download | android_bootable_recovery-cm-14.1.tar.gz android_bootable_recovery-cm-14.1.tar.bz2 android_bootable_recovery-cm-14.1.zip | |
DO NOT MERGE: Initialize the ZipArchive to zero before parsingcm-14.1
The fields of the ZipArchive on the stack are not initialized before we
call libminzip to parse the zip file. As a result, some random memory
location is freed unintentionally when we close the ZipArchive upon
parsing failures.
Bug: 35385357
Test: recompile and run the poc with asan.
Change-Id: I7e7f8ab4816c84a158af7389e1a889f8fc65f079
| -rw-r--r-- | install.cpp | 2 | ||||
| -rw-r--r-- | updater/updater.cpp | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/install.cpp b/install.cpp index 59b54e7f..16192123 100644 --- a/install.cpp +++ b/install.cpp @@ -530,7 +530,7 @@ really_install_package(const char *path, bool* wipe_cache, bool needs_mount, } // Try to open the package. - ZipArchive zip; + ZipArchive zip = {}; int err = mzOpenZipArchive(map.addr, map.length, &zip); if (err != 0) { LOGE("Can't open %s\n(%s)\n", path, err != -1 ? strerror(err) : "bad"); diff --git a/updater/updater.cpp b/updater/updater.cpp index e956dd55..96755735 100644 --- a/updater/updater.cpp +++ b/updater/updater.cpp @@ -77,7 +77,7 @@ int main(int argc, char** argv) { printf("failed to map package %s\n", argv[3]); return 3; } - ZipArchive za; + ZipArchive za = {}; int err; err = mzOpenZipArchive(map.addr, map.length, &za); if (err != 0) { |