tree e67d6d8b861198b42f3e46c71702630b6116042b
parent cc1ecf792f53fa6e9a7189506542bd428aa31a41
author Tianjie Xu <xunchang@google.com> 1481927275 -0800
committer Tianjie Xu <xunchang@google.com> 1481932902 -0800

Add a checker for signature boundary in verifier

The 'signature_start' variable marks the location of the signature
from the end of a zip archive. And a boundary check is missing where
'signature_start' should be within the EOCD comment field. This causes
problems when sideloading a malicious package. Also add a corresponding
test.

Bug: 31914369
Test: Verification fails correctly when sideloading recovery_test.zip on
angler.

Change-Id: I6ea96bf04dac5d8d4d6719e678d504f957b4d5c1