TheArchive/Magisk
1
0
Fork 0
mirror of https://github.com/topjohnwu/Magisk.git synced 2024-12-24 19:47:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential crash when traversing cpio entries

Browse Source
This commit is contained in:
topjohnwu 2019-09-22 06:15:19 -04:00
parent 748a35774f
commit 0fcd0de0d1
1 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
native/jni/magiskboot/ramdisk.cpp
View File

@ -44,11 +44,8 @@ void magisk_cpio::patch() {
fprintf(stderr, "Patch with flag KEEPVERITY=[%s] KEEPFORCEENCRYPT=[%s]\n", fprintf(stderr, "Patch with flag KEEPVERITY=[%s] KEEPFORCEENCRYPT=[%s]\n",
keepverity ? "true" : "false", keepforceencrypt ? "true" : "false"); keepverity ? "true" : "false", keepforceencrypt ? "true" : "false");
auto next = entries.begin(); for (auto it = entries.begin(); it != entries.end();) {
decltype(next) cur; auto cur = it++;
while (next != entries.end()) {
cur = next;
++next;
bool fstab = (!keepverity || !keepforceencrypt) && bool fstab = (!keepverity || !keepforceencrypt) &&
!str_starts(cur->first, ".backup") && !str_starts(cur->first, ".backup") &&
str_contains(cur->first, "fstab") && S_ISREG(cur->second->mode); str_contains(cur->first, "fstab") && S_ISREG(cur->second->mode);
@ -140,19 +137,19 @@ for (str = (char *) buf; str < (char *) buf + size; str = str += strlen(str) + 1
void magisk_cpio::restore() { void magisk_cpio::restore() {
decompress(); decompress();
char *file;
auto next = entries.begin(); if (auto it = entries.find(".backup/.rmlist"); it != entries.end()) {
decltype(next) cur; char *file;
while (next != entries.end()) { for_each_str(file, it->second->data, it->second->filesize)
cur = next; rm(file, false);
++next; rm(it);
}
for (auto it = entries.begin(); it != entries.end();) {
auto cur = it++;
if (str_starts(cur->first, ".backup")) { if (str_starts(cur->first, ".backup")) {
if (cur->first.length() == 7 || cur->first.substr(8) == ".magisk") { if (cur->first.length() == 7 || cur->first.substr(8) == ".magisk") {
rm(cur); rm(cur);
} else if (cur->first.substr(8) == ".rmlist") {
for_each_str(file, cur->second->data, cur->second->filesize)
rm(file, false);
rm(cur);
} else { } else {
mv(cur, &cur->first[8]); mv(cur, &cur->first[8]);
} }