tag | fb06f44e86eb7274f77ff805eed8208fba4f3aba | |
---|---|---|
tagger | The Android Open Source Project <initial-contribution@android.com> | Sun Jun 06 01:57:26 2021 -0700 |
object | 239ddbfc0ceed8ee3b2920a7b32218a84e160f61 |
Android Mainline 11.0.0 Release 22 (7197022)
commit | 239ddbfc0ceed8ee3b2920a7b32218a84e160f61 | [log] [tgz] |
---|---|---|
author | Bryan Ferris <bferris@google.com> | Wed Apr 22 15:13:11 2020 -0700 |
committer | Philip P. Moltmann <moltmann@google.com> | Wed Apr 29 14:59:32 2020 -0700 |
tree | 1538cef08e973378a87667f7833291c42e2d0d68 | |
parent | daaca9ec18f2b7cdec0a27d31b224297e166bbc0 [diff] |
Fix bounds check in ipp In ippReadIO, there is a check to ensure that the buffer contains at least 1 byte. However, when ipp->state is set to IPP_STATE_ATTRIBUTE, 4 bytes will be read. Test: Manual PoC from bug Test: `atest android.print.cts` - "all" selected in resulting menu Bug: 141551144 Change-Id: Ib3d4260899941f0c8050cf6d77a9022db63bdc66