summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJinguang Dong <dongjinguang@huawei.com>2017-04-05 21:55:29 +0000
committerandroid-build-merger <android-build-merger@google.com>2017-04-05 21:55:29 +0000
commit6ae350fa22a53b658237b6b4699c5b7c0de1df56 (patch)
tree3cb3eb550738b9ec4427562eccafd6e605fcfb72
parent56509312054d667c83e168f01037556edba747a5 (diff)
parent7f5c6593f298ebbef9d2a669118968ea3873aa9d (diff)
downloadgatekeeper-6ae350fa22a53b658237b6b4699c5b7c0de1df56.tar.gz
Fix a not properly handled pointer comparison that caused UB
am: 7f5c6593f2 Change-Id: I3a5115838bf239c3bda060a8a7fb4884b1f0e58f
-rw-r--r--gatekeeper_messages.cpp4
1 files changed, 2 insertions, 2 deletions
diff --git a/gatekeeper_messages.cpp b/gatekeeper_messages.cpp
index fc76d5e..41972bb 100644
--- a/gatekeeper_messages.cpp
+++ b/gatekeeper_messages.cpp
@@ -52,8 +52,8 @@ static inline gatekeeper_error_t read_from_buffer(const uint8_t **buffer, const
memcpy(&target->length, *buffer, sizeof(target->length));
*buffer += sizeof(target->length);
if (target->length != 0) {
- const uint8_t *buffer_end = *buffer + target->length;
- if (buffer_end > end || buffer_end <= *buffer) return ERROR_INVALID;
+ const size_t buffer_size = end - *buffer;
+ if (buffer_size < target->length) return ERROR_INVALID;
target->buffer.reset(new uint8_t[target->length]);
memcpy(target->buffer.get(), *buffer, target->length);