From f85b6eec468d0fcaebe190303deb99f3b6d7b894 Mon Sep 17 00:00:00 2001
From: Andrew Gunnerson <accounts+github@chiller3.com>
Date: Tue, 26 Sep 2023 23:47:50 -0400
Subject: [PATCH] bootimage: Fix panic when validating vendor v4 table size

The multiplication can overflow.

(Found by honggfuzz)

Issue: #160

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
---
 avbroot/src/format/bootimage.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/avbroot/src/format/bootimage.rs b/avbroot/src/format/bootimage.rs
index a5308e5..b077c16 100644
--- a/avbroot/src/format/bootimage.rs
+++ b/avbroot/src/format/bootimage.rs
@@ -1020,7 +1020,7 @@ impl<R: Read> FromReader<R> for VendorBootImageV3Through4 {
                     "vendor_ramdisk_table_entry_size",
                     table_entry_size,
                 ));
-            } else if table_size != table_entry_num * table_entry_size {
+            } else if table_entry_num.checked_mul(table_entry_size) != Some(table_size) {
                 return Err(Error::InvalidFieldValue(
                     "vendor_ramdisk_table_size",
                     table_size,