Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 019f4bd0 authored by Edwin Wong's avatar Edwin Wong Committed by Android (Google) Code Review
Browse files

Merge "[Fix vulnerability] Must validate input for decrypt." into tm-qpr-dev

parents 8492dd23 e63e9163

drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp

+5 −0
Original line number Diff line number Diff line
@@ -144,6 +144,11 @@ using ::aidl::android::hardware::drm::Status; 
            clearDataLengths.push_back(ss.numBytesOfClearData);

            encryptedDataLengths.push_back(ss.numBytesOfEncryptedData);

        }

        if (in_args.keyId.size() != kBlockSize || in_args.iv.size() != kBlockSize) {

            android_errorWriteLog(0x534e4554, "244569759");

            detailedError = "invalid decrypt parameter size";

            return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, detailedError);

        }

        auto res =

                mSession->decrypt(in_args.keyId.data(), in_args.iv.data(),

                                  srcPtr, static_cast<uint8_t*>(destPtr),

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

+5 −0
Original line number Diff line number Diff line
@@ -206,6 +206,11 @@ Return<void> CryptoPlugin::decrypt_1_2( 
        return Void();

    } else if (mode == Mode::AES_CTR) {

        size_t bytesDecrypted;

        if (keyId.size() != kBlockSize || iv.size() != kBlockSize) {

            android_errorWriteLog(0x534e4554, "244569759");

            _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "invalid decrypt parameter size");

            return Void();

        }

        Status_V1_2 res = mSession->decrypt(keyId.data(), iv.data(), srcPtr,

                static_cast<uint8_t*>(destPtr), toVector(subSamples), &bytesDecrypted);

        if (res == Status_V1_2::OK) {