diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2017-12-14 21:22:39 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2017-12-14 21:22:39 +0000 |
commit | 7de62777a0cd81c067c60032a9ed0a240f6fbe36 (patch) | |
tree | efd8ebb3dcb0d4d3ff62da4f43f425f1f3e80602 | |
parent | 3d522614ec13d9d3911a81789c6776332b82cb43 (diff) | |
parent | d6e8f9d5b9dca4d378a7519da77013a8f27b5ae8 (diff) | |
download | android_hardware_interfaces-7de62777a0cd81c067c60032a9ed0a240f6fbe36.tar.gz android_hardware_interfaces-7de62777a0cd81c067c60032a9ed0a240f6fbe36.tar.bz2 android_hardware_interfaces-7de62777a0cd81c067c60032a9ed0a240f6fbe36.zip |
Merge cherrypicks of [3365569, 3365570, 3366860, 3366878, 3365571, 3365572, 3366918, 3365573, 3365589, 3365590, 3366938, 3366902, 3365574, 3365575, 3365576, 3365577, 3366958, 3365824, 3365591, 3366959, 3366960, 3366961, 3366962, 3366963, 3366964, 3366965, 3366919, 3366966, 3366967, 3366968, 3366969, 3366970, 3367018, 3367019, 3365592, 3365593, 3366985, 3365825, 3366988, 3366989, 3366990, 3366991, 3366992, 3366993, 3366994, 3367004, 3367005, 3367006, 3367007, 3367008, 3367009, 3367010, 3367011, 3367012, 3367013, 3367014, 3367015, 3367016, 3367017, 3367038, 3367039, 3367040, 3367041, 3367042, 3367044, 3367045, 3367046, 3367049, 3367050, 3367052, 3367053, 3367054, 3367055, 3367056, 3366920, 3366921, 3366922, 3367079] into oc-mr1-release
Change-Id: I41e81da8c61c5c0a7a50749f23e55611a1efd33a
-rw-r--r-- | cas/1.0/default/DescramblerImpl.cpp | 53 |
1 files changed, 52 insertions, 1 deletions
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp index 3d90809cd..36699baf2 100644 --- a/cas/1.0/default/DescramblerImpl.cpp +++ b/cas/1.0/default/DescramblerImpl.cpp @@ -18,8 +18,9 @@ #define LOG_TAG "android.hardware.cas@1.0-DescramblerImpl" #include <hidlmemory/mapping.h> -#include <media/hardware/CryptoAPI.h> #include <media/cas/DescramblerAPI.h> +#include <media/hardware/CryptoAPI.h> +#include <media/stagefright/foundation/AUtils.h> #include <utils/Log.h> #include "DescramblerImpl.h" @@ -70,6 +71,11 @@ Return<bool> DescramblerImpl::requiresSecureDecoderComponent( return mPlugin->requiresSecureDecoderComponent(String8(mime.c_str())); } +static inline bool validateRangeForSize( + uint64_t offset, uint64_t length, uint64_t size) { + return isInRange<uint64_t, uint64_t>(0, size, offset, length); +} + Return<void> DescramblerImpl::descramble( ScramblingControl scramblingControl, const hidl_vec<SubSample>& subSamples, @@ -81,12 +87,57 @@ Return<void> DescramblerImpl::descramble( ALOGV("%s", __FUNCTION__); sp<IMemory> srcMem = mapMemory(srcBuffer.heapBase); + + // Validate if the offset and size in the SharedBuffer is consistent with the + // mapped ashmem, since the offset and size is controlled by client. + if (srcMem == NULL) { + ALOGE("Failed to map src buffer."); + _hidl_cb(toStatus(BAD_VALUE), 0, NULL); + return Void(); + } + if (!validateRangeForSize( + srcBuffer.offset, srcBuffer.size, (uint64_t)srcMem->getSize())) { + ALOGE("Invalid src buffer range: offset %llu, size %llu, srcMem size %llu", + srcBuffer.offset, srcBuffer.size, (uint64_t)srcMem->getSize()); + android_errorWriteLog(0x534e4554, "67962232"); + _hidl_cb(toStatus(BAD_VALUE), 0, NULL); + return Void(); + } + + // use 64-bit here to catch bad subsample size that might be overflowing. + uint64_t totalBytesInSubSamples = 0; + for (size_t i = 0; i < subSamples.size(); i++) { + totalBytesInSubSamples += (uint64_t)subSamples[i].numBytesOfClearData + + subSamples[i].numBytesOfEncryptedData; + } + // Further validate if the specified srcOffset and requested total subsample size + // is consistent with the source shared buffer size. + if (!validateRangeForSize(srcOffset, totalBytesInSubSamples, srcBuffer.size)) { + ALOGE("Invalid srcOffset and subsample size: " + "srcOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu", + srcOffset, totalBytesInSubSamples, srcBuffer.size); + android_errorWriteLog(0x534e4554, "67962232"); + _hidl_cb(toStatus(BAD_VALUE), 0, NULL); + return Void(); + } + void *srcPtr = (uint8_t *)(void *)srcMem->getPointer() + srcBuffer.offset; void *dstPtr = NULL; if (dstBuffer.type == BufferType::SHARED_MEMORY) { // When using shared memory, src buffer is also used as dst, // we don't map it again here. dstPtr = srcPtr; + + // In this case the dst and src would be the same buffer, need to validate + // dstOffset against the buffer size too. + if (!validateRangeForSize(dstOffset, totalBytesInSubSamples, srcBuffer.size)) { + ALOGE("Invalid dstOffset and subsample size: " + "dstOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu", + dstOffset, totalBytesInSubSamples, srcBuffer.size); + android_errorWriteLog(0x534e4554, "67962232"); + _hidl_cb(toStatus(BAD_VALUE), 0, NULL); + return Void(); + } } else { native_handle_t *handle = const_cast<native_handle_t *>( dstBuffer.secureMemory.getNativeHandle()); |