Validate decryption key length to decrypt function.
Cherry picked from http://go/ag/3038278. AesCtrDecryptor::decrypt() doesn't check whether the size of "key" is equal to 16 bytes, which may lead to an OOB read problem in the context of mediadrmserver. Add DecryptsWithEmptyKey and DecryptsWithKeyTooLong unit tests. Test: ClearKeyDrmUnitTest adb shell LD_LIBRARY_PATH="/vendor/lib/mediadrm" /data/nativetest/ClearKeyDrmUnitTest/ClearKeyDrmUnitTest bug: 63982768 Change-Id: I1f22c9df2b051972b2c532608b7f203e3ce77926 (cherry picked from commit 379b672b) CVE-2017-13201
Loading
Please register or sign in to comment