From 707cc79c4d2a385c1403c518d9a7192126d10e60 Mon Sep 17 00:00:00 2001 From: SangYoun Kwak Date: Tue, 31 Dec 2024 12:18:26 +0900 Subject: [PATCH] upgrade-apply: Modify to check th_get_size The return value of th_get_size() is int type, which means it can be negative value. Previously, the lvalue of assignment was size_t, which is unsigned integer while rvalue is the return value of th_get_size(). If the return value is positive, it is ok since size_t contains the range of positive range of int type. But if it is negative it can be a problem.(also it is an error) To resolve this issue, a code to check if the return value is negative or not before assigning it to size_t type variable. Change-Id: I947484daca4722d3783964ffb98ea85255998164 Signed-off-by: SangYoun Kwak --- src/upgrade-apply/patch/patch.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/upgrade-apply/patch/patch.c b/src/upgrade-apply/patch/patch.c index d863880..0e4cba5 100644 --- a/src/upgrade-apply/patch/patch.c +++ b/src/upgrade-apply/patch/patch.c @@ -217,6 +217,8 @@ static int open_files(struct bs_data *data, const char *source_file, const char assert(dest_file); assert(patch_tar); + int patch_len = 0; + data->src.fd = open_file(source_file, O_RDONLY); data->dest.fd = open_file(dest_file, O_RDWR); if (data->src.fd < 0 || @@ -226,7 +228,12 @@ static int open_files(struct bs_data *data, const char *source_file, const char data->patch_tar = patch_tar; data->src.len = get_file_len(data->src.fd); - data->patch_len = th_get_size(data->patch_tar); + + patch_len = th_get_size(data->patch_tar); + if (patch_len < 0) + return PF_ERROR_INVALID_PATCH_FILE; + data->patch_len = patch_len; + data->dest.len = dest_size == 0 ? get_file_len(data->dest.fd) : dest_size; data->patch_remaining = data->patch_len; -- 2.34.1