commit dc89abf3134573daa2a408b50536ead82d540465
author Manoj Gupta <manojgupta@google.com> Mon Dec 05 20:09:01 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Dec 05 20:09:01 2016 +0000
tree 50f1a7e9067643284ab3f6eb92282a32eb9c1d47
parent 0b6f2a6cd6d823bbc4028d7f470a62ba7ca23dc7
parent f7cea66b5e00df18df99be93b41c423ed6dd6aa1

Fix possible out of bound for program array
am: f7cea66b5e

Change-Id: Ic528a59aceb5c8a368c195d6de4fc9e3384292e4

apf_disassembler.c

diff --git a/apf_disassembler.c b/apf_disassembler.c
index 8fa200a..03e6a06 100644
--- a/apf_disassembler.c
+++ b/apf_disassembler.c
@@ -92,7 +92,7 @@
       if (len_field != 0) {
           const uint32_t imm_len = 1 << (len_field - 1);
           uint32_t i;
-          for (i = 0; i < imm_len; i++)
+          for (i = 0; i < imm_len && pc < program_len; i++)
               imm = (imm << 8) | program[pc++];
           // Sign extend imm into signed_imm.
           signed_imm = imm << ((4 - imm_len) * 8);
@@ -132,7 +132,7 @@
               } else {
                   uint32_t cmp_imm_len = 1 << (len_field - 1);
                   uint32_t i;
-                  for (i = 0; i < cmp_imm_len; i++)
+                  for (i = 0; i < cmp_imm_len && pc < program_len; i++)
                       cmp_imm = (cmp_imm << 8) | program[pc++];
                   printf("0x%x, ", cmp_imm);
               }