Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 498c4ed2 authored by Robert Shih's avatar Robert Shih Committed by Automerger Merge Worker
Browse files

Merge "clearkey hidl: fix oob read in decrypt" into qt-dev am: a0ec467e am: f4e93175 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/11348548

Change-Id: I08526f43916411eda4844ed925db888cc4dbcc70
parents 1928cddb f4e93175

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

+6 −3
Original line number Diff line number Diff line
@@ -148,14 +148,17 @@ Return<void> CryptoPlugin::decrypt_1_2( 
    // Calculate the output buffer size and determine if any subsamples are

    // encrypted.

    size_t destSize = 0;

    size_t srcSize = 0;

    bool haveEncryptedSubsamples = false;

    for (size_t i = 0; i < subSamples.size(); i++) {

        const SubSample &subSample = subSamples[i];

        if (__builtin_add_overflow(destSize, subSample.numBytesOfClearData, &destSize)) {

        if (__builtin_add_overflow(destSize, subSample.numBytesOfClearData, &destSize) ||

            __builtin_add_overflow(srcSize, subSample.numBytesOfClearData, &srcSize)) {

            _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "subsample clear size overflow");

            return Void();

        }

        if (__builtin_add_overflow(destSize, subSample.numBytesOfEncryptedData, &destSize)) {

        if (__builtin_add_overflow(destSize, subSample.numBytesOfEncryptedData, &destSize) ||

            __builtin_add_overflow(srcSize, subSample.numBytesOfEncryptedData, &srcSize)) {

            _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "subsample encrypted size overflow");

            return Void();

        }
@@ -164,7 +167,7 @@ Return<void> CryptoPlugin::decrypt_1_2( 
        }

    }



    if (destSize > destBuffer.size) {

    if (destSize > destBuffer.size || srcSize > source.size) {

        _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "subsample sum too large");

        return Void();

    }