commit f39f139103f8d06a0ec24f0d45e263f5c56a0c94
author Tianjie Xu <xunchang@google.com> Fri Sep 07 15:24:58 2018 -0700
committer Tianjie Xu <xunchang@google.com> Fri Sep 07 16:14:57 2018 -0700
tree 267c4e9b290a61345b75b253711ff362f193a2c1
parent 8e267878cca7785a3ec41c5160888bec65091fb3

DO NOT MERGE: Initialize the ZipArchive to zero before parsing

The fields of the ZipArchive on the stack are not initialized before we
call libminzip to parse the zip file. As a result, some random memory
location is freed unintentionally when we close the ZipArchive upon
parsing failures.

Bug: 35385357
Test: recompile and run the poc with asan.
Change-Id: I7e7f8ab4816c84a158af7389e1a889f8fc65f079

updater/updater.cpp

diff --git a/updater/updater.cpp b/updater/updater.cpp
index e956dd5..9675573 100644
--- a/updater/updater.cpp
+++ b/updater/updater.cpp
@@ -77,7 +77,7 @@
         printf("failed to map package %s\n", argv[3]);
         return 3;
     }
-    ZipArchive za;
+    ZipArchive za = {};
     int err;
     err = mzOpenZipArchive(map.addr, map.length, &za);
     if (err != 0) {