Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de686a4f authored by Jeff Tinker's avatar Jeff Tinker Committed by Ryan Longair
Browse files

Fix potential buffer overflow in mediadrmserver 

bug:71389378
test: gts media tests

Change-Id: Ic7d4b456bc874b92fbe202e3dafb7ceac747ebc7
(cherry picked from commit 5231cc16)
parent 3d3a3308

drm/libmediadrm/ICrypto.cpp

+9 −2
Original line number Diff line number Diff line
@@ -16,14 +16,14 @@ 


//#define LOG_NDEBUG 0

#define LOG_TAG "ICrypto"

#include <utils/Log.h>



#include <binder/Parcel.h>

#include <binder/IMemory.h>

#include <cutils/log.h>

#include <media/ICrypto.h>

#include <media/stagefright/MediaErrors.h>

#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AString.h>

#include <utils/Log.h>



namespace android {
@@ -362,6 +362,13 @@ status_t BnCrypto::onTransact( 
                    reply->writeInt32(BAD_VALUE);

                    return OK;

                }

                sp<IMemory> dest = destination.mSharedMemory;

                if (totalSize > dest->size() ||

                        (size_t)dest->offset() > dest->size() - totalSize) {

                    reply->writeInt32(BAD_VALUE);

                    android_errorWriteLog(0x534e4554, "71389378");

                    return OK;

                }

            }



            AString errorDetailMsg;