mirror of
https://github.com/topjohnwu/Magisk.git
synced 2025-12-05 20:40:19 -08:00
Compare commits
2 Commits
4ee2235961
...
c8d51b38ba
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
c8d51b38ba | ||
|
|
f741a4aeb8 |
@@ -279,9 +279,10 @@ static int find_dtb_offset(const uint8_t *buf, unsigned sz) {
|
||||
|
||||
auto fdt_hdr = reinterpret_cast<const fdt_header *>(curr);
|
||||
|
||||
// Check that fdt_header.totalsize does not overflow kernel image size
|
||||
// Check that fdt_header.totalsize does not overflow kernel image size or is empty dtb
|
||||
// https://github.com/torvalds/linux/commit/7b937cc243e5b1df8780a0aa743ce800df6c68d1
|
||||
uint32_t totalsize = fdt_hdr->totalsize;
|
||||
if (totalsize > end - curr)
|
||||
if (totalsize > end - curr || totalsize <= 0x48)
|
||||
continue;
|
||||
|
||||
// Check that fdt_header.off_dt_struct does not overflow kernel image size
|
||||
|
||||
@@ -208,6 +208,12 @@ bool ZygiskContext::plt_hook_commit() {
|
||||
{
|
||||
mutex_guard lock(hook_info_lock);
|
||||
plt_hook_process_regex();
|
||||
for (auto& reg: register_info) {
|
||||
regfree(®.regex);
|
||||
}
|
||||
for (auto& ign: ignore_info) {
|
||||
regfree(&ign.regex);
|
||||
}
|
||||
register_info.clear();
|
||||
ignore_info.clear();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user