tree 48af319d2bb447694b589f7da2d531471936d26e
parent 410b9a75d25fed7d9d0162f3c4bd2f2fa2ab4f41
author Ryan Mitchell <rtmitchell@google.com> 1566585904 -0700
committer Ryan Mitchell <rtmitchell@google.com> 1581103614 +0000

Fix security issue in DynamicRefTable::load.

A crafted resources arsc could cause libandroidfw to read data out of
bounds of the resources arsc. This change updates the logic to calculate
whether the ref table chunk is large enough to hold the number of
entries specified in the header.

Bug: 129475100
Test: adb shell push ResTableTest data
Test: adb shell push poc.arsc data
Test: ./ResTableTest poc.arsc
Change-Id: Ifbaad87bdbcb7eecf554ef362e0118f53532a22a
(cherry picked from commit 8da1c38b69e947885fcec50cda46c5472ddb6746)