am 3ca99f6c: Merge "fix vulnerability in bspatch"

* commit '3ca99f6cb8ffbe19c7ef5409f3dac18ea0c254bd': fix vulnerability in bspatch
2014-05-16 15:03:24 +00:00
parent d2fb4ed589 3ca99f6cb8
commit d4592694b4
1 changed files with 5 additions and 0 deletions
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.c
@@ -205,6 +205,11 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
        ctrl[1] = offtin(buf+8);
        ctrl[2] = offtin(buf+16);

+        if (ctrl[0] < 0 || ctrl[1] < 0) {
+            printf("corrupt patch (negative byte counts)\n");
+            return 1;
+        }
+
        // Sanity check
        if (newpos + ctrl[0] > *new_size) {
            printf("corrupt patch (new file overrun)\n");