Merge cherrypicks of [13524839, 13524840, 13524841, 13524928, 13524929, 13524930, 13522744, 13524951, 13524860, 13524371, 13524372, 13524373, 13524374, 13524861, 13525166, 13525167, 13525168, 13524843, 13524957, 13524958, 13524936, 13525246, 13524939, 13524940, 13525248, 13524942, 13525249, 13525250, 13525251, 13524943, 13525169, 13525170, 13524358, 13524961, 13524962, 13524963, 13524966, 13524844, 13525325, 13525326, 13524964, 13525327, 13525328, 13524359, 13525307, 13525345] into rvc-qpr2-releaseandroid-11.0.0_r37android-11.0.0_r36android-11.0.0_r35android-11.0.0_r34android11-qpr2-release

Change-Id: I994061fc6ddf68f64c6516636c6b69b76f91973d

1 files changed, 5 insertions, 1 deletions

diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 2db360765b..e6d4e8447b 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -124,7 +124,11 @@ namespace implementation {
             return Void();
         }
 
-        if (source.offset + offset + source.size > sourceBase->getSize()) {
+        size_t totalSize = 0;
+        if (__builtin_add_overflow(source.offset, offset, &totalSize) ||
+            __builtin_add_overflow(totalSize, source.size, &totalSize) ||
+            totalSize > sourceBase->getSize()) {
+            android_errorWriteLog(0x534e4554, "176496160");
             _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
             return Void();
         }