Merge "Fix security vulnerability in CryptoHal" into oc-dev (20e00b3f) · Commits · e / os / android_frameworks_av

drm/libmediadrm/CryptoHal.cpp

+21 −4

Original line number	Diff line number	Diff line
		@@ -240,11 +240,12 @@ int32_t CryptoHal::setHeapBase(const sp<IMemoryHeap>& heap) {
		Mutex::Autolock autoLock(mLock);

		int32_t seqNum = mHeapSeqNum++;

		int fd = heap->getHeapID();
		nativeHandle->data[0] = fd;
		auto hidlHandle = hidl_handle(nativeHandle);
		auto hidlMemory = hidl_memory("ashmem", hidlHandle, heap->getSize());
		mHeapBases.add(seqNum, mNextBufferId);
		mHeapBases.add(seqNum, HeapBase(mNextBufferId, heap->getSize()));
		Return<void> hResult = mPlugin->setSharedBufferBase(hidlMemory, mNextBufferId++);
		ALOGE_IF(!hResult.isOk(), "setSharedBufferBase(): remote call failed");
		return seqNum;
		@@ -269,10 +270,26 @@ status_t CryptoHal::toSharedBuffer(const sp<IMemory>& memory, int32_t seqNum, ::
		return UNEXPECTED_NULL;
		}

		// memory must be in the declared heap
		CHECK(mHeapBases.indexOfKey(seqNum) >= 0);
		// memory must be in one of the heaps that have been set
		if (mHeapBases.indexOfKey(seqNum) < 0) {
		return UNKNOWN_ERROR;
		}

		// heap must be the same size as the one that was set in setHeapBase
		if (mHeapBases.valueFor(seqNum).getSize() != heap->getSize()) {
		android_errorWriteLog(0x534e4554, "76221123");
		return UNKNOWN_ERROR;
		}

		// memory must be within the address space of the heap
		if (memory->pointer() != static_cast<uint8_t *>(heap->getBase()) + memory->offset() \|\|
		heap->getSize() < memory->offset() + memory->size() \|\|
		SIZE_MAX - memory->offset() < memory->size()) {
		android_errorWriteLog(0x534e4554, "76221123");
		return UNKNOWN_ERROR;
		}

		buffer->bufferId = mHeapBases.valueFor(seqNum);
		buffer->bufferId = mHeapBases.valueFor(seqNum).getBufferId();
		buffer->offset = offset >= 0 ? offset : 0;
		buffer->size = size;
		return OK;

media/libmedia/include/media/CryptoHal.h

+14 −1

Original line number	Diff line number	Diff line
		@@ -79,7 +79,20 @@ private:
		*/
		status_t mInitCheck;

		KeyedVector<int32_t, uint32_t> mHeapBases;
		struct HeapBase {
		HeapBase() : mBufferId(0), mSize(0) {}
		HeapBase(uint32_t bufferId, size_t size) :
		mBufferId(bufferId), mSize(size) {}

		uint32_t getBufferId() const {return mBufferId;}
		size_t getSize() const {return mSize;}

		private:
		uint32_t mBufferId;
		size_t mSize;
		};

		KeyedVector<int32_t, HeapBase> mHeapBases;
		uint32_t mNextBufferId;
		int32_t mHeapSeqNum;