diff options
author | Robert Shih <robertshih@google.com> | 2019-09-11 21:23:06 -0700 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2019-09-11 21:23:06 -0700 |
commit | 4d3b73ee5e72070af8352bb59f1ab2b8e89b3f73 (patch) | |
tree | 078853afcc78ca96bb93d4586b59d9249ad11e5a | |
parent | 84cd010990ae801b94fe16653fcd3a5cd6073c5a (diff) | |
parent | 02ef6a6283a97b968ff0d7bfa1537f48e0565912 (diff) | |
download | android_hardware_interfaces-4d3b73ee5e72070af8352bb59f1ab2b8e89b3f73.tar.gz android_hardware_interfaces-4d3b73ee5e72070af8352bb59f1ab2b8e89b3f73.tar.bz2 android_hardware_interfaces-4d3b73ee5e72070af8352bb59f1ab2b8e89b3f73.zip |
default hidl CryptoPlugin: security fixes am: 1e18883b72
am: 02ef6a6283
Change-Id: I19a3ea993f954db12008af47d0f14f97962d92fb
-rw-r--r-- | drm/1.0/default/CryptoPlugin.cpp | 30 |
1 files changed, 26 insertions, 4 deletions
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp index 666653b26..8ddc38022 100644 --- a/drm/1.0/default/CryptoPlugin.cpp +++ b/drm/1.0/default/CryptoPlugin.cpp @@ -101,11 +101,20 @@ namespace implementation { std::unique_ptr<android::CryptoPlugin::SubSample[]> legacySubSamples = std::make_unique<android::CryptoPlugin::SubSample[]>(subSamples.size()); + size_t destSize = 0; for (size_t i = 0; i < subSamples.size(); i++) { - legacySubSamples[i].mNumBytesOfClearData - = subSamples[i].numBytesOfClearData; - legacySubSamples[i].mNumBytesOfEncryptedData - = subSamples[i].numBytesOfEncryptedData; + uint32_t numBytesOfClearData = subSamples[i].numBytesOfClearData; + legacySubSamples[i].mNumBytesOfClearData = numBytesOfClearData; + uint32_t numBytesOfEncryptedData = subSamples[i].numBytesOfEncryptedData; + legacySubSamples[i].mNumBytesOfEncryptedData = numBytesOfEncryptedData; + if (__builtin_add_overflow(destSize, numBytesOfClearData, &destSize)) { + _hidl_cb(Status::BAD_VALUE, 0, "subsample clear size overflow"); + return Void(); + } + if (__builtin_add_overflow(destSize, numBytesOfEncryptedData, &destSize)) { + _hidl_cb(Status::BAD_VALUE, 0, "subsample encrypted size overflow"); + return Void(); + } } AString detailMessage; @@ -137,11 +146,24 @@ namespace implementation { _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); } + + if (destSize > destBuffer.size) { + _hidl_cb(Status::BAD_VALUE, 0, "subsample sum too large"); + return Void(); + } + destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset); } else if (destination.type == BufferType::NATIVE_HANDLE) { + if (!secure) { + _hidl_cb(Status::BAD_VALUE, 0, "native handle destination must be secure"); + return Void(); + } native_handle_t *handle = const_cast<native_handle_t *>( destination.secureMemory.getNativeHandle()); destPtr = static_cast<void *>(handle); + } else { + _hidl_cb(Status::BAD_VALUE, 0, "invalid destination type"); + return Void(); } ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(), legacyMode, legacyPattern, srcPtr, legacySubSamples.get(), |