Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9390a744 authored by Marco Nelissen's avatar Marco Nelissen Committed by Dang Duy Son
Browse files

Fix overflow check and check read result 

Bug: 33861560
Test: build
AOSP-Change-Id: Ia85519766e19a6e37237166f309750b3e8323c4e

CVE-2017-0547

(cherry picked from commit 9667e3ef)

Change-Id: I171aa1c7c4a4a5095ac7041371db14e3a4f3676a
(cherry picked from commit 0836dbb8)
parent 4fa74eb2

media/libmedia/IHDCP.cpp

+10 −8
Original line number Diff line number Diff line
@@ -241,14 +241,11 @@ status_t BnHDCP::onTransact( 
        case HDCP_ENCRYPT:

        {

            size_t size = data.readInt32();

            size_t bufSize = 2 * size;



            // watch out for overflow

            void *inData = NULL;

            if (bufSize > size) {

                inData = malloc(bufSize);

            // watch out for overflow

            if (size <= SIZE_MAX / 2) {

                inData = malloc(2 * size);

            }



            if (inData == NULL) {

                reply->writeInt32(ERROR_OUT_OF_RANGE);

                return OK;
@@ -256,11 +253,16 @@ status_t BnHDCP::onTransact( 


            void *outData = (uint8_t *)inData + size;



            data.read(inData, size);

            status_t err = data.read(inData, size);

            if (err != OK) {

                free(inData);

                reply->writeInt32(err);

                return OK;

            }



            uint32_t streamCTR = data.readInt32();

            uint64_t inputCTR;

            status_t err = encrypt(inData, size, streamCTR, &inputCTR, outData);

            err = encrypt(inData, size, streamCTR, &inputCTR, outData);



            reply->writeInt32(err);