Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d37728a8 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "Fix overflow check and check read result" into klp-dev am: b6aa3901... 

Merge "Fix overflow check and check read result" into klp-dev am: b6aa3901 am: e541fa17 am: 7f3980c0 am: ea202340 am: 3fc94bc1 am: 497f2ccc am: 91703373 am: 3b122332 am: 89cbb848 am: 3ce7b4dd am: 96fbe3c2 am: d625f8dc am: d5726329 am: 72ff5265
am: 60a16aeb

Change-Id: I17ba6c5a443428297977ec342eb71b04884c6522
parents b5f3a88d 60a16aeb

media/libmedia/IHDCP.cpp

+10 −8
Original line number Original line Diff line number Diff line
@@ -241,14 +241,11 @@ status_t BnHDCP::onTransact( 
        case HDCP_ENCRYPT:

        case HDCP_ENCRYPT:

        {

        {

            size_t size = data.readInt32();

            size_t size = data.readInt32();

            size_t bufSize = 2 * size;



            // watch out for overflow

            void *inData = NULL;

            void *inData = NULL;

            if (bufSize > size) {

            // watch out for overflow

                inData = malloc(bufSize);

            if (size <= SIZE_MAX / 2) {

                inData = malloc(2 * size);

            }

            }



            if (inData == NULL) {

            if (inData == NULL) {

                reply->writeInt32(ERROR_OUT_OF_RANGE);

                reply->writeInt32(ERROR_OUT_OF_RANGE);

                return OK;

                return OK;
@@ -256,11 +253,16 @@ status_t BnHDCP::onTransact( 




            void *outData = (uint8_t *)inData + size;

            void *outData = (uint8_t *)inData + size;





            data.read(inData, size);

            status_t err = data.read(inData, size);

            if (err != OK) {

                free(inData);

                reply->writeInt32(err);

                return OK;

            }





            uint32_t streamCTR = data.readInt32();

            uint32_t streamCTR = data.readInt32();

            uint64_t inputCTR;

            uint64_t inputCTR;

            status_t err = encrypt(inData, size, streamCTR, &inputCTR, outData);

            err = encrypt(inData, size, streamCTR, &inputCTR, outData);





            reply->writeInt32(err);

            reply->writeInt32(err);