diff options
author | Robert Shih <robertshih@google.com> | 2019-09-11 21:10:00 -0700 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2019-09-11 21:10:00 -0700 |
commit | 756f134fcc9f88a5c65e5254f486c062c44b2f9a (patch) | |
tree | 6af0181914e0cf9cd334e4a675a224746d952d32 | |
parent | 099b9145998528b17aec6fb19450f4ac7b4b5aef (diff) | |
parent | d22f1447fe2fc10dbf45bde6fb4a7cb6f7a8a7ca (diff) | |
download | android_hardware_interfaces-756f134fcc9f88a5c65e5254f486c062c44b2f9a.tar.gz android_hardware_interfaces-756f134fcc9f88a5c65e5254f486c062c44b2f9a.tar.bz2 android_hardware_interfaces-756f134fcc9f88a5c65e5254f486c062c44b2f9a.zip |
default hidl CryptoPlugin: security fixes [RESTRICT AUTOMERGE]
am: d22f1447fe
Change-Id: I480b83a0c4ffd752637ff5357b30d6f5c1916b4b
-rw-r--r-- | drm/1.0/default/CryptoPlugin.cpp | 35 |
1 files changed, 31 insertions, 4 deletions
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp index 591861aee..6626c0172 100644 --- a/drm/1.0/default/CryptoPlugin.cpp +++ b/drm/1.0/default/CryptoPlugin.cpp @@ -98,11 +98,22 @@ namespace implementation { android::CryptoPlugin::SubSample *legacySubSamples = new android::CryptoPlugin::SubSample[subSamples.size()]; + size_t destSize = 0; for (size_t i = 0; i < subSamples.size(); i++) { - legacySubSamples[i].mNumBytesOfClearData - = subSamples[i].numBytesOfClearData; - legacySubSamples[i].mNumBytesOfEncryptedData - = subSamples[i].numBytesOfEncryptedData; + uint32_t numBytesOfClearData = subSamples[i].numBytesOfClearData; + legacySubSamples[i].mNumBytesOfClearData = numBytesOfClearData; + uint32_t numBytesOfEncryptedData = subSamples[i].numBytesOfEncryptedData; + legacySubSamples[i].mNumBytesOfEncryptedData = numBytesOfEncryptedData; + if (__builtin_add_overflow(destSize, numBytesOfClearData, &destSize)) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample clear size overflow"); + return Void(); + } + if (__builtin_add_overflow(destSize, numBytesOfEncryptedData, &destSize)) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample encrypted size overflow"); + return Void(); + } } AString detailMessage; @@ -125,11 +136,27 @@ namespace implementation { _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); } + + if (destSize > destBuffer.size) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample sum too large"); + return Void(); + } + destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset); } else if (destination.type == BufferType::NATIVE_HANDLE) { + if (!secure) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "native handle destination must be secure"); + return Void(); + } native_handle_t *handle = const_cast<native_handle_t *>( destination.secureMemory.getNativeHandle()); destPtr = static_cast<void *>(handle); + } else { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "invalid destination type"); + return Void(); } ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(), legacyMode, legacyPattern, srcPtr, legacySubSamples, |