Gitiles
Code Review Sign In
gerrit.twrp.me / android_bootable_recovery / e830a51351f4e22e3e88cc226863db05297e6250
commite830a51351f4e22e3e88cc226863db05297e6250[log] [tgz]
authorTianjie Xu <xunchang@google.com>Fri Sep 07 15:24:58 2018 -0700
committerTianjie Xu <xunchang@google.com>Fri Sep 07 16:09:28 2018 -0700
tree2932324bc62e6f3dc701ac190cda7aec5e992533
parent510b13acd87b3b88975617d166412c4e3248f2d3 [diff]
DO NOT MERGE: Initialize the ZipArchive to zero before parsing

The fields of the ZipArchive on the stack are not initialized before we
call libminzip to parse the zip file. As a result, some random memory
location is freed unintentionally when we close the ZipArchive upon
parsing failures.

Bug: 35385357
Test: recompile and run the poc with asan.
Change-Id: I7e7f8ab4816c84a158af7389e1a889f8fc65f079
2 files changed
tree: 2932324bc62e6f3dc701ac190cda7aec5e992533
  1. applypatch/
  2. edify/
  3. etc/
  4. fonts/
  5. minadbd/
  6. minui/
  7. minzip/
  8. mtdutils/
  9. otafault/
  10. res-hdpi/
  11. res-mdpi/
  12. res-xhdpi/
  13. res-xxhdpi/
  14. res-xxxhdpi/
  15. tests/
  16. tools/
  17. uncrypt/
  18. update_verifier/
  19. updater/
  20. res-560dpi ⇨ res-xxxhdpi
  21. adb_install.cpp
  22. adb_install.h
  23. Android.mk
  24. asn1_decoder.cpp
  25. asn1_decoder.h
  26. bootloader.cpp
  27. bootloader.h
  28. CleanSpec.mk
  29. common.h
  30. default_device.cpp
  31. device.cpp
  32. device.h
  33. error_code.h
  34. fuse_sdcard_provider.cpp
  35. fuse_sdcard_provider.h
  36. fuse_sideload.cpp
  37. fuse_sideload.h
  38. install.cpp
  39. install.h
  40. interlace-frames.py
  41. NOTICE
  42. print_sha1.h
  43. README.md
  44. recovery-persist.cpp
  45. recovery-persist.rc
  46. recovery-refresh.cpp
  47. recovery-refresh.rc
  48. recovery.cpp
  49. roots.cpp
  50. roots.h
  51. screen_ui.cpp
  52. screen_ui.h
  53. ui.cpp
  54. ui.h
  55. unique_fd.h
  56. verifier.cpp
  57. verifier.h
  58. wear_touch.cpp
  59. wear_touch.h
  60. wear_ui.cpp
  61. wear_ui.h
README.md

The Recovery Image

Quick turn-around testing

mm -j && m ramdisk-nodeps && m recoveryimage-nodeps

# To boot into the new recovery image
# without flashing the recovery partition:
adb reboot bootloader
fastboot boot $ANDROID_PRODUCT_OUT/recovery.img

Running the tests

# After setting up environment and lunch.
mmma -j bootable/recovery

# Running the tests on device.
adb root
adb sync data

# 32-bit device
adb shell /data/nativetest/recovery_unit_test/recovery_unit_test
adb shell /data/nativetest/recovery_component_test/recovery_component_test

# Or 64-bit device
adb shell /data/nativetest64/recovery_unit_test/recovery_unit_test
adb shell /data/nativetest64/recovery_component_test/recovery_component_test