diff options
| author | android-build-team Robot <android-build-team-robot@google.com> | 2021-03-10 00:52:34 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-03-10 00:52:34 +0000 |
| commit | 3e76685bdad74b6babad9516b9c56597a49d9d53 (patch) | |
| tree | 0711ed677684c877bb1e25145fd7bb87c47dc070 | |
| parent | dcf9d048a7664181d3e4c0c11765b320b9545390 (diff) | |
| parent | 65b4e4b7bf84f1e3f1f7b191a8a2971bbbb7cb3c (diff) | |
| download | platform_hardware_interfaces-3e76685bdad74b6babad9516b9c56597a49d9d53.tar.gz platform_hardware_interfaces-3e76685bdad74b6babad9516b9c56597a49d9d53.tar.bz2 platform_hardware_interfaces-3e76685bdad74b6babad9516b9c56597a49d9d53.zip | |
Merge cherrypicks of [13524839, 13524840, 13524841, 13524928, 13524929, 13524930, 13522744, 13524951, 13524860, 13524371, 13524372, 13524373, 13524374, 13524861, 13525166, 13525167, 13525168, 13524843, 13524957, 13524958, 13524936, 13525246, 13524939, 13524940, 13525248, 13524942, 13525249, 13525250, 13525251, 13524943, 13525169, 13525170, 13524358, 13524961, 13524962, 13524963, 13524966, 13524844, 13525325, 13525326, 13524964, 13525327, 13525328, 13524359, 13525307, 13525345] into rvc-qpr2-release am: 65b4e4b7bf
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13524378
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I65300daf1efccef5e73ec6dfee1bd81c55992ca5
| -rw-r--r-- | drm/1.0/default/CryptoPlugin.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp index 2db360765b..e6d4e8447b 100644 --- a/drm/1.0/default/CryptoPlugin.cpp +++ b/drm/1.0/default/CryptoPlugin.cpp @@ -124,7 +124,11 @@ namespace implementation { return Void(); } - if (source.offset + offset + source.size > sourceBase->getSize()) { + size_t totalSize = 0; + if (__builtin_add_overflow(source.offset, offset, &totalSize) || + __builtin_add_overflow(totalSize, source.size, &totalSize) || + totalSize > sourceBase->getSize()) { + android_errorWriteLog(0x534e4554, "176496160"); _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); } |