commit c4804e9b9c143652d17441b4b672b920b11cc94a
author Doug Zongker <dougz@google.com> Fri May 16 15:06:23 2014 +0000
committer Android Git Automerger <android-git-automerger@android.com> Fri May 16 15:06:23 2014 +0000
tree 65f33edad5871413e4c6aba9dd129de96cf9ae77
parent 0766cdf49acb77677864995e931eec391243505d
parent d4592694b41d5f8309d98cd3312b5486216cc685

am d4592694: am 3ca99f6c: Merge "fix vulnerability in bspatch"

* commit 'd4592694b41d5f8309d98cd3312b5486216cc685':
  fix vulnerability in bspatch

applypatch/bspatch.c

diff --git a/applypatch/bspatch.c b/applypatch/bspatch.c
index 2e80f81..1dc7ab1 100644
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.c
@@ -205,6 +205,11 @@
         ctrl[1] = offtin(buf+8);
         ctrl[2] = offtin(buf+16);
 
+        if (ctrl[0] < 0 || ctrl[1] < 0) {
+            printf("corrupt patch (negative byte counts)\n");
+            return 1;
+        }
+
         // Sanity check
         if (newpos + ctrl[0] > *new_size) {
             printf("corrupt patch (new file overrun)\n");