fix: handle larger axml namespace headers than known (#3210)

This commit is contained in:
Connor Tumbleson 2023-07-24 06:23:25 -04:00 committed by GitHub
parent 03c198c1e4
commit 490b6f8aee
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -676,12 +676,13 @@ public class AXmlResourceParser implements XmlResourceParser {
}
int chunkType;
int headerSize = 0;
if (event == START_DOCUMENT) {
// Fake event, see CHUNK_XML_START_TAG handler.
chunkType = ARSCHeader.RES_XML_START_ELEMENT_TYPE;
} else {
chunkType = mIn.readShort();
mIn.skipShort(); // headerSize
headerSize = mIn.readShort();
}
if (chunkType == ARSCHeader.RES_XML_RESOURCE_MAP_TYPE) {
@ -718,6 +719,14 @@ public class AXmlResourceParser implements XmlResourceParser {
mIn.skipInt(); // uri
mNamespaces.pop();
}
// Check for larger header than we read. We know the current header is 0x10 bytes, but some apps
// are packed with a larger header of unknown data.
if (headerSize > 0x10) {
int bytesToSkip = headerSize - 0x10;
LOGGER.warning(String.format("AXML header larger than 0x10 bytes, skipping %d bytes.", bytesToSkip));
mIn.skipBytes(bytesToSkip);
}
continue;
}