From aaa3b6bbf2e8bf5949a3b9af27c0a458fe62828d Mon Sep 17 00:00:00 2001 From: Elliott Hughes Date: Thu, 18 Jan 2018 16:08:24 -0800 Subject: [PATCH] Fix fastboot memory corruption. Bug: http://b/68664649 Test: echo 'ANDROID!' > fake.img ; fastboot -c `python -c "print 'A'*4000"` boot fake.img Change-Id: I3299e0fba24a6c1f6178c994731a94cea68f7254 --- fastboot/bootimg_utils.cpp | 8 +++++--- fastboot/fastboot.cpp | 5 ++++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fastboot/bootimg_utils.cpp b/fastboot/bootimg_utils.cpp index c1028ef3c..62a26b30a 100644 --- a/fastboot/bootimg_utils.cpp +++ b/fastboot/bootimg_utils.cpp @@ -28,13 +28,15 @@ #include "bootimg_utils.h" +#include "fastboot.h" + #include #include #include -void bootimg_set_cmdline(boot_img_hdr* h, const char* cmdline) -{ - strcpy((char*) h->cmdline, cmdline); +void bootimg_set_cmdline(boot_img_hdr* h, const char* cmdline) { + if (strlen(cmdline) >= sizeof(h->cmdline)) die("command line too large: %zu", strlen(cmdline)); + strcpy(reinterpret_cast(h->cmdline), cmdline); } boot_img_hdr* mkbootimg(void* kernel, int64_t kernel_size, off_t kernel_offset, diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp index 6175f59ef..536d64e4c 100644 --- a/fastboot/fastboot.cpp +++ b/fastboot/fastboot.cpp @@ -447,8 +447,11 @@ static void* load_bootable_image(const std::string& kernel, const std::string& r if (kdata == nullptr) die("cannot load '%s': %s", kernel.c_str(), strerror(errno)); // Is this actually a boot image? + if (ksize < static_cast(sizeof(boot_img_hdr))) { + die("cannot load '%s': too short", kernel.c_str()); + } if (!memcmp(kdata, BOOT_MAGIC, BOOT_MAGIC_SIZE)) { - if (cmdline) bootimg_set_cmdline((boot_img_hdr*) kdata, cmdline); + if (cmdline) bootimg_set_cmdline(reinterpret_cast(kdata), cmdline); if (!ramdisk.empty()) die("cannot boot a boot.img *and* ramdisk");