commit ddb1b744983e37b51fc20759bbf8dac31f4d30ad
author Doug Zongker <dougz@google.com> Fri May 16 15:09:35 2014 +0000
committer Android Git Automerger <android-git-automerger@android.com> Fri May 16 15:09:35 2014 +0000
tree 02e2420d49536bf886ea14256bd087ada49592e4
parent eed64836386a64cc945e7e9a01a96ed0d6fa57af
parent c4804e9b9c143652d17441b4b672b920b11cc94a

am c4804e9b: am d4592694: am 3ca99f6c: Merge "fix vulnerability in bspatch"

* commit 'c4804e9b9c143652d17441b4b672b920b11cc94a':
  fix vulnerability in bspatch

applypatch/bspatch.c

diff --git a/applypatch/bspatch.c b/applypatch/bspatch.c
index 2e80f81..1dc7ab1 100644
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.c
@@ -205,6 +205,11 @@
         ctrl[1] = offtin(buf+8);
         ctrl[2] = offtin(buf+16);
 
+        if (ctrl[0] < 0 || ctrl[1] < 0) {
+            printf("corrupt patch (negative byte counts)\n");
+            return 1;
+        }
+
         // Sanity check
         if (newpos + ctrl[0] > *new_size) {
             printf("corrupt patch (new file overrun)\n");