commit 8c515631874d78ca9d2c34ea12ab7ddd1665da0e
author Tianjie Xu <xunchang@google.com> Fri Dec 16 16:24:09 2016 -0800
committer gitbuildkicker <android-build@google.com> Fri Jan 20 13:44:56 2017 -0800
tree f90c7c7c1e65b8ad4279dfe4883e46a80e0a7321
parent 37d7d67ca216972cba9259aa5866220d6abfaf14

Add a checker for signature boundary in verifier

The 'signature_start' variable marks the location of the signature
from the end of a zip archive. And a boundary check is missing where
'signature_start' should be within the EOCD comment field. This causes
problems when sideloading a malicious package. Also add a corresponding
test.

Bug: 31914369
Test: Verification fails correctly when sideloading recovery_test.zip on
angler.

Change-Id: I6ea96bf04dac5d8d4d6719e678d504f957b4d5c1
(cherry-picked from f69e6a9475983b2ad46729e44ab58d2b22cd74d0)

(cherry picked from commit 54ea136fded56810bf475885eb4bd7bf1b11f09c)

verifier.cpp

diff --git a/verifier.cpp b/verifier.cpp
index 16cc7cf..2d1b0e7 100644
--- a/verifier.cpp
+++ b/verifier.cpp
@@ -146,6 +146,12 @@
     LOGI("comment is %zu bytes; signature %zu bytes from end\n",
          comment_size, signature_start);
 
+    if (signature_start > comment_size) {
+        LOGE("signature start: %zu is larger than comment size: %zu\n", signature_start,
+             comment_size);
+        return VERIFY_FAILURE;
+    }
+
     if (signature_start <= FOOTER_SIZE) {
         LOGE("Signature start is in the footer");
         return VERIFY_FAILURE;