commit 324eb2c6b049f1677133f0b708730e904c5e73ab
author Mathieu Chartier <mathieuc@google.com> Mon Mar 14 11:02:59 2016 -0700
committer Mathieu Chartier <mathieuc@google.com> Mon Mar 14 13:25:35 2016 -0700
tree bb73dbd46c5b64c525814b66f77fd4581e08b15f
parent dd6558da4bbd11a430268bff7d886b7fcb071dc4

Do not include image header in decompressed size

Could cause a buffer overflow since we told LZ4 to decompress more
bytes than necessary.

Bug: 27561308
Change-Id: Ic938f3e67f8c0627f203ad7261d4342ce43157cd

runtime/gc/space/image_space.cc

diff --git a/runtime/gc/space/image_space.cc b/runtime/gc/space/image_space.cc
index 357ba94..bea1dcc 100644
--- a/runtime/gc/space/image_space.cc
+++ b/runtime/gc/space/image_space.cc
@@ -1207,7 +1207,7 @@
                                      /*out*/out_error_msg));
       if (map != nullptr) {
         const size_t stored_size = image_header->GetDataSize();
-        const size_t write_offset = sizeof(ImageHeader);  // Skip the header.
+        const size_t decompress_offset = sizeof(ImageHeader);  // Skip the header.
         std::unique_ptr<MemMap> temp_map(MemMap::MapFile(sizeof(ImageHeader) + stored_size,
                                                          PROT_READ,
                                                          MAP_PRIVATE,
@@ -1226,14 +1226,15 @@
         TimingLogger::ScopedTiming timing2("LZ4 decompress image", &logger);
         const size_t decompressed_size = LZ4_decompress_safe(
             reinterpret_cast<char*>(temp_map->Begin()) + sizeof(ImageHeader),
-            reinterpret_cast<char*>(map->Begin()) + write_offset,
+            reinterpret_cast<char*>(map->Begin()) + decompress_offset,
             stored_size,
-            map->Size());
+            map->Size() - decompress_offset);
         VLOG(image) << "Decompressing image took " << PrettyDuration(NanoTime() - start);
         if (decompressed_size + sizeof(ImageHeader) != image_header->GetImageSize()) {
-          *error_msg = StringPrintf("Decompressed size does not match expected image size %zu vs %zu",
-                                    decompressed_size + sizeof(ImageHeader),
-                                    image_header->GetImageSize());
+          *error_msg = StringPrintf(
+              "Decompressed size does not match expected image size %zu vs %zu",
+              decompressed_size + sizeof(ImageHeader),
+              image_header->GetImageSize());
           return nullptr;
         }
       }