Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f811d448 authored by Edwin Wong's avatar Edwin Wong
Browse files

Fix JsonWebKey potential null pointer dereference 

In extractKeysFromJsonWebKeySet, if mJsonObjects size
is zero, mJsonObjects[0] will result in a null pointer
dereference.

Test: sts-tradefed
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176496483#testPocBug_176496483

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-17649648364

Bug: 176496483
Bug: 175955261
Change-Id: Ib70f1c6f9abb8f2628abb229fc389b83bf6e7552
parent ac91bb22

drm/mediadrm/plugins/clearkey/default/JsonWebKey.cpp

+1 −1
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ bool JsonWebKey::extractKeysFromJsonWebKeySet(const String8& jsonWebKeySet, 
    // all the base64 encoded keys. Each key is also stored separately as

    // a JSON object in mJsonObjects[1..n] where n is the total

    // number of keys in the set.

    if (!isJsonWebKeySet(mJsonObjects[0])) {

    if (mJsonObjects.size() == 0 || !isJsonWebKeySet(mJsonObjects[0])) {

        return false;

    }

drm/mediadrm/plugins/clearkey/hidl/JsonWebKey.cpp

+1 −1
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ bool JsonWebKey::extractKeysFromJsonWebKeySet(const std::string& jsonWebKeySet, 
    // all the base64 encoded keys. Each key is also stored separately as

    // a JSON object in mJsonObjects[1..n] where n is the total

    // number of keys in the set.

    if (!isJsonWebKeySet(mJsonObjects[0])) {

    if (mJsonObjects.size() == 0 || !isJsonWebKeySet(mJsonObjects[0])) {

        return false;

    }