Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b3fc840 authored by Edwin Wong's avatar Edwin Wong Committed by Android (Google) Code Review
Browse files

Merge "Fix potential decrypt destPtr overflow." into rvc-dev

parents 78cc1229 49c0fe41
Loading
Loading
Loading
Loading
+5 −3
Original line number Diff line number Diff line
@@ -142,13 +142,15 @@ Return<void> CryptoPlugin::decrypt_1_2(

    base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer()));

    if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
    totalSize = 0;
    if (__builtin_add_overflow(destBuffer.offset, destBuffer.size, &totalSize) ||
        totalSize > destBase->getSize()) {
        android_errorWriteLog(0x534e4554, "176444622");
        _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size");
        return Void();
    }
    destPtr = static_cast<void*>(base + destination.nonsecureMemory.offset);


    // Calculate the output buffer size and determine if any subsamples are
    // encrypted.
    size_t destSize = 0;