commit 18c66d8fee0e0dd8681182a59b59119a21e09c0c
author Yurii Zubrytskyi <zyy@google.com> Mon Nov 29 23:55:24 2021 -0800
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Dec 15 00:02:00 2021 +0000
tree 858b83f559bb7da23b9cf7925a4af32837e3e59e
parent b52de33e3b3e2b4863341ff86262e17c97094bc1

Add missing size check when parsing staged aliases

Need to have the same kind of data size check as in other
types parsing

Bug: 203938029
Test: manual
Change-Id: I9f5d2851ff59da90163ead6c0416f0bba3868cc4
Merged-In: I9f5d2851ff59da90163ead6c0416f0bba3868cc4
(cherry picked from commit 8002034e6b11e9be85671505475936b1ec3705b3)
(cherry picked from commit abdf5a518db1d09b2918c4286d226d409ee24420)
Merged-In:I9f5d2851ff59da90163ead6c0416f0bba3868cc4

libs/androidfw/LoadedArsc.cpp

diff --git a/libs/androidfw/LoadedArsc.cpp b/libs/androidfw/LoadedArsc.cpp
index d17c328..8150e78 100644
--- a/libs/androidfw/LoadedArsc.cpp
+++ b/libs/androidfw/LoadedArsc.cpp
@@ -686,6 +686,12 @@
         std::unordered_set<uint32_t> finalized_ids;
         const auto lib_alias = child_chunk.header<ResTable_staged_alias_header>();
         if (!lib_alias) {
+          LOG(ERROR) << "RES_TABLE_STAGED_ALIAS_TYPE is too small.";
+          return {};
+        }
+        if ((child_chunk.data_size() / sizeof(ResTable_staged_alias_entry))
+            < dtohl(lib_alias->count)) {
+          LOG(ERROR) << "RES_TABLE_STAGED_ALIAS_TYPE is too small to hold entries.";
           return {};
         }
         const auto entry_begin = child_chunk.data_ptr().convert<ResTable_staged_alias_entry>();