Check for overflow before allocating memory fore decompression.
On 32bit devices, an ZipEntry64 may have size > 2^32, we should check
for such cases before attempting to allocate memory.
Test: mm -j
Change-Id: I0f916ef4b2a692f167719a74bd6ff2e887c6c2ce
diff --git a/install/install.cpp b/install/install.cpp
index 7533732..1b220cb 100644
--- a/install/install.cpp
+++ b/install/install.cpp
@@ -246,7 +246,13 @@
LOG(ERROR) << "Failed to find " << AB_OTA_PAYLOAD_PROPERTIES;
return false;
}
- uint32_t properties_entry_length = properties_entry.uncompressed_length;
+ auto properties_entry_length = properties_entry.uncompressed_length;
+ if (properties_entry_length > std::numeric_limits<size_t>::max()) {
+ LOG(ERROR) << "Failed to extract " << AB_OTA_PAYLOAD_PROPERTIES
+ << " because's uncompressed size exceeds size of address space. "
+ << properties_entry_length;
+ return false;
+ }
std::vector<uint8_t> payload_properties(properties_entry_length);
int32_t err =
ExtractToMemory(zip, &properties_entry, payload_properties.data(), properties_entry_length);