Commit: 6fb68bb196c6861c7fe9e6da8104dd278e625610 - system-coremmmm (git)

system/corennnnn

Commit MetaInfo

• Revision: 6fb68bb196c6861c7fe9e6da8104dd278e625610 (tree)
• Time: 2016-10-07 09:26:31
• Author: Tianjie Xu <xunchang@goog...>
• Commiter: android-build-merger

Log Message

Fix out of bound access in libziparchive am: 1ee4892e66 am: c24dd97654 am: 8788591224 am: 167562aa76 am: 398adf9b55 am: 680c3f1dc4
am: f0ce69815f

Change-Id: I8e69df083b6d5cd3a7e6bf7113ae836932c2e9f2

Change Summary

• modified: libziparchive/zip_archive.cc

Incremental Difference

--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -269,9 +269,14 @@ static int32_t MapCentralDirectory0(int fd, const char* debug_file_name,
    * Grab the CD offset and size, and the number of entries in the
    * archive and verify that they look reasonable.
    */
-  if (eocd->cd_start_offset + eocd->cd_size > eocd_offset) {
+  if (static_cast<off64_t>(eocd->cd_start_offset) + eocd->cd_size > eocd_offset) {
     ALOGW("Zip: bad offsets (dir %" PRIu32 ", size %" PRIu32 ", eocd %" PRId64 ")",
         eocd->cd_start_offset, eocd->cd_size, static_cast<int64_t>(eocd_offset));
+#if defined(__ANDROID__)
+    if (eocd->cd_start_offset + eocd->cd_size <= eocd_offset) {
+      android_errorWriteLog(0x534e4554, "31251826");
+    }
+#endif
     return kInvalidOffset;
   }
   if (eocd->num_records == 0) {