Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e18883b authored by Robert Shih's avatar Robert Shih
Browse files

default hidl CryptoPlugin: security fixes 

* reject native handle output for clearkey
* validate subsample sizes

Bug: 137370777
Test: cryptopoc
Change-Id: Idf075e1a297fe1ab3ea3e1621806dd46b4a51e35
parent 222d825e

drm/1.0/default/CryptoPlugin.cpp

+26 −4
Original line number Original line Diff line number Diff line
@@ -102,11 +102,20 @@ namespace implementation { 
        std::unique_ptr<android::CryptoPlugin::SubSample[]> legacySubSamples =

        std::unique_ptr<android::CryptoPlugin::SubSample[]> legacySubSamples =

                std::make_unique<android::CryptoPlugin::SubSample[]>(subSamples.size());

                std::make_unique<android::CryptoPlugin::SubSample[]>(subSamples.size());





        size_t destSize = 0;

        for (size_t i = 0; i < subSamples.size(); i++) {

        for (size_t i = 0; i < subSamples.size(); i++) {

            legacySubSamples[i].mNumBytesOfClearData

            uint32_t numBytesOfClearData = subSamples[i].numBytesOfClearData;

                = subSamples[i].numBytesOfClearData;

            legacySubSamples[i].mNumBytesOfClearData = numBytesOfClearData;

            legacySubSamples[i].mNumBytesOfEncryptedData

            uint32_t numBytesOfEncryptedData = subSamples[i].numBytesOfEncryptedData;

                = subSamples[i].numBytesOfEncryptedData;

            legacySubSamples[i].mNumBytesOfEncryptedData = numBytesOfEncryptedData;

            if (__builtin_add_overflow(destSize, numBytesOfClearData, &destSize)) {

                _hidl_cb(Status::BAD_VALUE, 0, "subsample clear size overflow");

                return Void();

            }

            if (__builtin_add_overflow(destSize, numBytesOfEncryptedData, &destSize)) {

                _hidl_cb(Status::BAD_VALUE, 0, "subsample encrypted size overflow");

                return Void();

            }

        }

        }





        AString detailMessage;

        AString detailMessage;
@@ -138,11 +147,24 @@ namespace implementation { 
                _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");

                _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");

                return Void();

                return Void();

            }

            }



            if (destSize > destBuffer.size) {

                _hidl_cb(Status::BAD_VALUE, 0, "subsample sum too large");

                return Void();

            }



            destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset);

            destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset);

        } else if (destination.type == BufferType::NATIVE_HANDLE) {

        } else if (destination.type == BufferType::NATIVE_HANDLE) {

            if (!secure) {

                _hidl_cb(Status::BAD_VALUE, 0, "native handle destination must be secure");

                return Void();

            }

            native_handle_t *handle = const_cast<native_handle_t *>(

            native_handle_t *handle = const_cast<native_handle_t *>(

                    destination.secureMemory.getNativeHandle());

                    destination.secureMemory.getNativeHandle());

            destPtr = static_cast<void *>(handle);

            destPtr = static_cast<void *>(handle);

        } else {

            _hidl_cb(Status::BAD_VALUE, 0, "invalid destination type");

            return Void();

        }

        }

        ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(),

        ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(),

                legacyMode, legacyPattern, srcPtr, legacySubSamples.get(),

                legacyMode, legacyPattern, srcPtr, legacySubSamples.get(),