Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d7d0e69 authored by Kyle Zhang's avatar Kyle Zhang
Browse files

Fix mSession NULL dereference 

Bug: 230793853
Test: clearkeyV1.4_fuzzer
Change-Id: I3f11b133a4854a9ef896c9f5042bd719527c3fa6
parent e62e6933

drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp

+3 −0
Original line number Original line Diff line number Diff line
@@ -137,6 +137,8 @@ using ::aidl::android::hardware::drm::Status; 
        *_aidl_return = static_cast<ssize_t>(offset);

        *_aidl_return = static_cast<ssize_t>(offset);

        return toNdkScopedAStatus(Status::OK);

        return toNdkScopedAStatus(Status::OK);

    } else if (in_args.mode == Mode::AES_CTR) {

    } else if (in_args.mode == Mode::AES_CTR) {

        if (!mSession) return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE,

                    "session not found");

        size_t bytesDecrypted{};

        size_t bytesDecrypted{};

        std::vector<int32_t> clearDataLengths;

        std::vector<int32_t> clearDataLengths;

        std::vector<int32_t> encryptedDataLengths;

        std::vector<int32_t> encryptedDataLengths;
@@ -149,6 +151,7 @@ using ::aidl::android::hardware::drm::Status; 
            detailedError = "invalid decrypt parameter size";

            detailedError = "invalid decrypt parameter size";

            return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, detailedError);

            return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, detailedError);

        }

        }



        auto res =

        auto res =

                mSession->decrypt(in_args.keyId.data(), in_args.iv.data(),

                mSession->decrypt(in_args.keyId.data(), in_args.iv.data(),

                                  srcPtr, static_cast<uint8_t*>(destPtr),

                                  srcPtr, static_cast<uint8_t*>(destPtr),

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

+4 −0
Original line number Original line Diff line number Diff line
@@ -211,6 +211,10 @@ Return<void> CryptoPlugin::decrypt_1_2( 
            _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "invalid decrypt parameter size");

            _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "invalid decrypt parameter size");

            return Void();

            return Void();

        }

        }

        if (!mSession) {

            _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "session not found");

            return Void();

        }

        Status_V1_2 res = mSession->decrypt(keyId.data(), iv.data(), srcPtr,

        Status_V1_2 res = mSession->decrypt(keyId.data(), iv.data(), srcPtr,

                static_cast<uint8_t*>(destPtr), toVector(subSamples), &bytesDecrypted);

                static_cast<uint8_t*>(destPtr), toVector(subSamples), &bytesDecrypted);

        if (res == Status_V1_2::OK) {

        if (res == Status_V1_2::OK) {