Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8797836 authored by Jeff Tinker's avatar Jeff Tinker Committed by android-build-merger
Browse files

Fix potential buffer overflow in mediadrmserver am: 5231cc16 am: 15a7d8c0 

am: 54b0a54b

Change-Id: I4a9005d159649603117eecc2b69a0c6f308c3cac
parents 311b6040 54b0a54b

drm/libmediadrm/ICrypto.cpp

+9 −2
Original line number Diff line number Diff line
@@ -16,14 +16,14 @@ 


//#define LOG_NDEBUG 0

#define LOG_TAG "ICrypto"

#include <utils/Log.h>



#include <binder/Parcel.h>

#include <binder/IMemory.h>

#include <cutils/log.h>

#include <media/ICrypto.h>

#include <media/stagefright/MediaErrors.h>

#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AString.h>

#include <utils/Log.h>



namespace android {
@@ -362,6 +362,13 @@ status_t BnCrypto::onTransact( 
                    reply->writeInt32(BAD_VALUE);

                    return OK;

                }

                sp<IMemory> dest = destination.mSharedMemory;

                if (totalSize > dest->size() ||

                        (size_t)dest->offset() > dest->size() - totalSize) {

                    reply->writeInt32(BAD_VALUE);

                    android_errorWriteLog(0x534e4554, "71389378");

                    return OK;

                }

            }



            AString errorDetailMsg;