Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf11d8f7 authored by Jeff Tinker's avatar Jeff Tinker Committed by android-build-merger
Browse files

Fix potential buffer overflow in mediadrmserver am: 5231cc16 am: 15a7d8c0 am: 54b0a54b 

am: c8797836

Change-Id: I51dd484521508341c56668b40ac44a9bb3d5d185
parents 66d3fc1f c8797836

drm/libmediadrm/ICrypto.cpp

+9 −2
Original line number Diff line number Diff line
@@ -16,14 +16,14 @@ 


//#define LOG_NDEBUG 0

#define LOG_TAG "ICrypto"

#include <utils/Log.h>



#include <binder/Parcel.h>

#include <binder/IMemory.h>

#include <cutils/log.h>

#include <media/ICrypto.h>

#include <media/stagefright/MediaErrors.h>

#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AString.h>

#include <utils/Log.h>



namespace android {
@@ -362,6 +362,13 @@ status_t BnCrypto::onTransact( 
                    reply->writeInt32(BAD_VALUE);

                    return OK;

                }

                sp<IMemory> dest = destination.mSharedMemory;

                if (totalSize > dest->size() ||

                        (size_t)dest->offset() > dest->size() - totalSize) {

                    reply->writeInt32(BAD_VALUE);

                    android_errorWriteLog(0x534e4554, "71389378");

                    return OK;

                }

            }



            AString errorDetailMsg;