Fix fastboot memory corruption.
Bug: http://b/68664649
Test: echo 'ANDROID!' > fake.img ; fastboot -c `python -c "print 'A'*4000"` boot fake.img
Change-Id: I3299e0fba24a6c1f6178c994731a94cea68f7254
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index 6175f59..536d64e 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -447,8 +447,11 @@
if (kdata == nullptr) die("cannot load '%s': %s", kernel.c_str(), strerror(errno));
// Is this actually a boot image?
+ if (ksize < static_cast<int64_t>(sizeof(boot_img_hdr))) {
+ die("cannot load '%s': too short", kernel.c_str());
+ }
if (!memcmp(kdata, BOOT_MAGIC, BOOT_MAGIC_SIZE)) {
- if (cmdline) bootimg_set_cmdline((boot_img_hdr*) kdata, cmdline);
+ if (cmdline) bootimg_set_cmdline(reinterpret_cast<boot_img_hdr*>(kdata), cmdline);
if (!ramdisk.empty()) die("cannot boot a boot.img *and* ramdisk");