tree 74152d042e4a0e2b6568c6da69ff59ef70e7a720
parent 702542818f7c8828f53e0f6eca05eb540c4f2394
author Sen Jiang <senj@google.com> 1462569445 -0700
committer Sen Jiang <senj@google.com> 1462574810 -0700

Fix segmentation fault with certain files.

The bug was introduced when we replaced qsufsort with divsufsort, the
implementation of qsufsort in bsdiff will set I[oldsize] for some reason,
and later on search() might access I[oldsize] in a corner case. But
divsufsort will only set I[0...oldsize-1] which is WAI, and now I[oldsize]
will be random.

The search() function is basically a binary search, and the end should
be oldsize-1 so that it will never access I[oldsize].

Interestingly, it will only segfault when used in imgdiff, even if I
extract the same old data and new data passed to bsdiff() and call bsdiff
binary with the files, segfault disappears, probably because imgdiff did
many malloc and free before calling bsdiff and the memory already contains
random data, whereas in bsdiff binary that is always 0. That's probably
why we did not encounter this bug in Chrome OS.

Bug: 28631841
Test: `imgdiff boot.img recovery.img recovery_from_boot.p` from shamu build

Change-Id: If10ec64b125131b348444364626307d379c2b8ba