diff options
| author | Edwin Wong <edwinwong@google.com> | 2021-02-03 23:32:35 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-02-03 23:32:35 +0000 |
| commit | e289b4aa839a1bdfd2c9a25a0e8e11b76f81da4b (patch) | |
| tree | 92c2449413b1ad1be832e578e5ffa05061e64332 /drm | |
| parent | e42109b559280b4a7d3f4551ed5298edc73eb7db (diff) | |
| parent | 107233b3ddf157b4a009faca90e9490bfa67aa6d (diff) | |
Fix potential decrypt src pointer overflow. am: c14f262876 am: 107233b3dd
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13472562
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I000cf080faddadcf8773f84f7fd3a44d3edd7164
Diffstat (limited to 'drm')
| -rw-r--r-- | drm/1.0/default/CryptoPlugin.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp index 2db360765b..e6d4e8447b 100644 --- a/drm/1.0/default/CryptoPlugin.cpp +++ b/drm/1.0/default/CryptoPlugin.cpp @@ -124,7 +124,11 @@ namespace implementation { return Void(); } - if (source.offset + offset + source.size > sourceBase->getSize()) { + size_t totalSize = 0; + if (__builtin_add_overflow(source.offset, offset, &totalSize) || + __builtin_add_overflow(totalSize, source.size, &totalSize) || + totalSize > sourceBase->getSize()) { + android_errorWriteLog(0x534e4554, "176496160"); _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); } |