| commit | 239ddbfc0ceed8ee3b2920a7b32218a84e160f61 | [log] [tgz] |
|---|---|---|
| author | Bryan Ferris <bferris@google.com> | Wed Apr 22 15:13:11 2020 -0700 |
| committer | Philip P. Moltmann <moltmann@google.com> | Wed Apr 29 14:59:32 2020 -0700 |
| tree | 1538cef08e973378a87667f7833291c42e2d0d68 | |
| parent | daaca9ec18f2b7cdec0a27d31b224297e166bbc0 [diff] |
Fix bounds check in ipp In ippReadIO, there is a check to ensure that the buffer contains at least 1 byte. However, when ipp->state is set to IPP_STATE_ATTRIBUTE, 4 bytes will be read. Test: Manual PoC from bug Test: `atest android.print.cts` - "all" selected in resulting menu Bug: 141551144 Change-Id: Ib3d4260899941f0c8050cf6d77a9022db63bdc66