Fix segmentation fault with certain files.
The bug was introduced when we replaced qsufsort with divsufsort, the implementation of qsufsort in bsdiff will set I[oldsize] for some reason, and later on search() might access I[oldsize] in a corner case. But divsufsort will only set I[0...oldsize-1] which is WAI, and now I[oldsize] will be random. The search() function is basically a binary search, and the end should be oldsize-1 so that it will never access I[oldsize]. Interestingly, it will only segfault when used in imgdiff, even if I extract the same old data and new data passed to bsdiff() and call bsdiff binary with the files, segfault disappears, probably because imgdiff did many malloc and free before calling bsdiff and the memory already contains random data, whereas in bsdiff binary that is always 0. That's probably why we did not encounter this bug in Chrome OS. Bug: 28631841 Test: `imgdiff boot.img recovery.img recovery_from_boot.p` from shamu build Change-Id: If10ec64b125131b348444364626307d379c2b8ba
Loading
Please sign in to comment