summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeff Tinker <jtinker@google.com>2018-10-08 15:26:28 +0300
committerTim Schumacher <timschumi@gmx.de>2018-12-03 17:02:09 +0100
commit9127c1fd403ca552950e6e0f9fe34d27fbb21bf4 (patch)
treeb8f1763512d7b0ee4cc85268d0f57633dcf8c9d5
parentfd974399aa40e7bfee3761d73f445a816a6fdb57 (diff)
downloadframeworks_av-9127c1fd403ca552950e6e0f9fe34d27fbb21bf4.tar.gz
frameworks_av-9127c1fd403ca552950e6e0f9fe34d27fbb21bf4.tar.bz2
frameworks_av-9127c1fd403ca552950e6e0f9fe34d27fbb21bf4.zip
Fix information disclosure in mediadrmserver
Test:POC provided in bug Bug:79218474 (cherry picked from commit c1bf68a8d1321d7cdf7da6933f0b89b171d251c6) Change-Id: Iba12c07a5e615f8ed234b01ac53e3559ba9ac12e
-rw-r--r--media/libmedia/ICrypto.cpp9
1 files changed, 7 insertions, 2 deletions
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index bc696cabee..3f27618fb2 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -195,8 +195,13 @@ IMPLEMENT_META_INTERFACE(Crypto, "android.hardware.ICrypto");
void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
uint32_t size = data.readInt32();
- vector.insertAt((size_t)0, size);
- data.read(vector.editArray(), size);
+ if (vector.insertAt((size_t)0, size) < 0) {
+ vector.clear();
+ }
+ if (data.read(vector.editArray(), size) != NO_ERROR) {
+ vector.clear();
+ ALOGE("62872384");
+ }
}
void BnCrypto::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {