diff options
author | Bernie Innocenti <codewiz@google.com> | 2018-04-02 14:52:50 +0900 |
---|---|---|
committer | Bernie Innocenti <codewiz@google.com> | 2018-04-02 18:59:21 +0900 |
commit | 5a1f7799656e73736b9a07ee564b9349c4a1b40f (patch) | |
tree | 5b38fa42763cba13b6963b504e4fb5a820b63f2c | |
parent | c206315b2faf7f0a59dbd64376de38e3d116534e (diff) | |
download | apf-5a1f7799656e73736b9a07ee564b9349c4a1b40f.tar.gz |
apf: Fix bound-checking to allow accessing the last data byte.
Bug: 73804303
Test: runtest -x frameworks/base/tests/net/java/android/net/apf/ApfTest.java
Merged-In: I3543eedac5998d6a1b16010b5dc8865e9cc24b5b
Change-Id: I3543eedac5998d6a1b16010b5dc8865e9cc24b5b
(cherry picked from commit 7024456a1fb07f0a88ed8dbeeba41c21a4a40304)
-rw-r--r-- | apf_interpreter.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/apf_interpreter.c b/apf_interpreter.c index f5e0072..e2f46cb 100644 --- a/apf_interpreter.c +++ b/apf_interpreter.c @@ -42,7 +42,7 @@ int accept_packet(const uint8_t* program, uint32_t program_len, // Is access to offset |p| length |size| within data bounds? #define IN_DATA_BOUNDS(p, size) (ENFORCE_UNSIGNED(p) && \ ENFORCE_UNSIGNED(size) && \ - (p) + (size) < data_len && \ + (p) + (size) <= data_len && \ (p) + (size) >= (p)) // catch wraparounds // Accept packet if not within program bounds #define ASSERT_IN_PROGRAM_BOUNDS(p) ASSERT_RETURN(IN_PROGRAM_BOUNDS(p)) |