Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 230f58c0 authored by Robert Shih's avatar Robert Shih
Browse files

clearkey hidl: parsePssh securely 

Bug: 137282168
Test: drmpoc
Change-Id: I480ee99778f8c774cb5b857b25c32d926270092d
parent 5e9bb0c4

drm/mediadrm/plugins/clearkey/hidl/InitDataParser.cpp

+17 −6
Original line number Diff line number Diff line
@@ -85,10 +85,21 @@ Status InitDataParser::parse(const std::vector<uint8_t>& initData, 


Status InitDataParser::parsePssh(const std::vector<uint8_t>& initData,

        std::vector<const uint8_t*>* keyIds) {

    // Description of PSSH format:

    // https://w3c.github.io/encrypted-media/format-registry/initdata/cenc.html

    size_t readPosition = 0;



    // Validate size field

    uint32_t expectedSize = initData.size();

    const char psshIdentifier[4] = {'p', 's', 's', 'h'};

    const uint8_t psshVersion1[4] = {1, 0, 0, 0};

    uint32_t keyIdCount = 0;

    size_t headerSize = sizeof(expectedSize) + sizeof(psshIdentifier) +

                        sizeof(psshVersion1) + kSystemIdSize + sizeof(keyIdCount);

    if (initData.size() < headerSize) {

        return Status::ERROR_DRM_CANNOT_HANDLE;

    }



    // Validate size field

    expectedSize = htonl(expectedSize);

    if (memcmp(&initData[readPosition], &expectedSize,

               sizeof(expectedSize)) != 0) {
@@ -97,7 +108,6 @@ Status InitDataParser::parsePssh(const std::vector<uint8_t>& initData, 
    readPosition += sizeof(expectedSize);



    // Validate PSSH box identifier

    const char psshIdentifier[4] = {'p', 's', 's', 'h'};

    if (memcmp(&initData[readPosition], psshIdentifier,

               sizeof(psshIdentifier)) != 0) {

        return Status::ERROR_DRM_CANNOT_HANDLE;
@@ -105,7 +115,6 @@ Status InitDataParser::parsePssh(const std::vector<uint8_t>& initData, 
    readPosition += sizeof(psshIdentifier);



    // Validate EME version number

    const uint8_t psshVersion1[4] = {1, 0, 0, 0};

    if (memcmp(&initData[readPosition], psshVersion1,

               sizeof(psshVersion1)) != 0) {

        return Status::ERROR_DRM_CANNOT_HANDLE;
@@ -119,12 +128,14 @@ Status InitDataParser::parsePssh(const std::vector<uint8_t>& initData, 
    readPosition += kSystemIdSize;



    // Read key ID count

    uint32_t keyIdCount;

    memcpy(&keyIdCount, &initData[readPosition], sizeof(keyIdCount));

    keyIdCount = ntohl(keyIdCount);

    readPosition += sizeof(keyIdCount);

    if (readPosition + ((uint64_t)keyIdCount * kKeyIdSize) !=

            initData.size() - sizeof(uint32_t)) {



    uint64_t psshSize = 0;

    if (__builtin_mul_overflow(keyIdCount, kKeyIdSize, &psshSize) ||

        __builtin_add_overflow(readPosition, psshSize, &psshSize) ||

        psshSize != initData.size() - sizeof(uint32_t) /* DataSize(0) */) {

        return Status::ERROR_DRM_CANNOT_HANDLE;

    }