tag | 8baeef10b7dc787581af1a0dd7c9e02de4284618 | |
---|---|---|
tagger | The Android Open Source Project <initial-contribution@android.com> | Mon Jun 07 23:03:37 2021 -0700 |
object | 239ddbfc0ceed8ee3b2920a7b32218a84e160f61 |
Android Mainline 11.0.0 Release 31 (7313725)
commit | 239ddbfc0ceed8ee3b2920a7b32218a84e160f61 | [log] [tgz] |
---|---|---|
author | Bryan Ferris <bferris@google.com> | Wed Apr 22 15:13:11 2020 -0700 |
committer | Philip P. Moltmann <moltmann@google.com> | Wed Apr 29 14:59:32 2020 -0700 |
tree | 1538cef08e973378a87667f7833291c42e2d0d68 | |
parent | daaca9ec18f2b7cdec0a27d31b224297e166bbc0 [diff] |
Fix bounds check in ipp In ippReadIO, there is a check to ensure that the buffer contains at least 1 byte. However, when ipp->state is set to IPP_STATE_ATTRIBUTE, 4 bytes will be read. Test: Manual PoC from bug Test: `atest android.print.cts` - "all" selected in resulting menu Bug: 141551144 Change-Id: Ib3d4260899941f0c8050cf6d77a9022db63bdc66