diff options
author | Robert Shih <robertshih@google.com> | 2019-09-11 21:18:04 -0700 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2019-09-11 21:18:04 -0700 |
commit | f6e7c9ed25df49bfd0c9f6f9ebf40154ebff5cda (patch) | |
tree | 529b575b9d900e34314005a6f59484819562fa45 | |
parent | d86c5a905ad0c4e59f51e2867a9694482c682797 (diff) | |
parent | 756f134fcc9f88a5c65e5254f486c062c44b2f9a (diff) | |
download | android_hardware_interfaces-f6e7c9ed25df49bfd0c9f6f9ebf40154ebff5cda.tar.gz android_hardware_interfaces-f6e7c9ed25df49bfd0c9f6f9ebf40154ebff5cda.tar.bz2 android_hardware_interfaces-f6e7c9ed25df49bfd0c9f6f9ebf40154ebff5cda.zip |
default hidl CryptoPlugin: security fixes [RESTRICT AUTOMERGE] am: d22f1447fe
am: 756f134fcc
Change-Id: I4289e38c6eab3e8cac9e489a08f74b3efcf008f9
-rw-r--r-- | drm/1.0/default/CryptoPlugin.cpp | 35 |
1 files changed, 31 insertions, 4 deletions
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp index fd75dbd3f..aa5c6edc6 100644 --- a/drm/1.0/default/CryptoPlugin.cpp +++ b/drm/1.0/default/CryptoPlugin.cpp @@ -102,11 +102,22 @@ namespace implementation { android::CryptoPlugin::SubSample *legacySubSamples = new android::CryptoPlugin::SubSample[subSamples.size()]; + size_t destSize = 0; for (size_t i = 0; i < subSamples.size(); i++) { - legacySubSamples[i].mNumBytesOfClearData - = subSamples[i].numBytesOfClearData; - legacySubSamples[i].mNumBytesOfEncryptedData - = subSamples[i].numBytesOfEncryptedData; + uint32_t numBytesOfClearData = subSamples[i].numBytesOfClearData; + legacySubSamples[i].mNumBytesOfClearData = numBytesOfClearData; + uint32_t numBytesOfEncryptedData = subSamples[i].numBytesOfEncryptedData; + legacySubSamples[i].mNumBytesOfEncryptedData = numBytesOfEncryptedData; + if (__builtin_add_overflow(destSize, numBytesOfClearData, &destSize)) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample clear size overflow"); + return Void(); + } + if (__builtin_add_overflow(destSize, numBytesOfEncryptedData, &destSize)) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample encrypted size overflow"); + return Void(); + } } AString detailMessage; @@ -138,11 +149,27 @@ namespace implementation { _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); } + + if (destSize > destBuffer.size) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "subsample sum too large"); + return Void(); + } + destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset); } else if (destination.type == BufferType::NATIVE_HANDLE) { + if (!secure) { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "native handle destination must be secure"); + return Void(); + } native_handle_t *handle = const_cast<native_handle_t *>( destination.secureMemory.getNativeHandle()); destPtr = static_cast<void *>(handle); + } else { + delete[] legacySubSamples; + _hidl_cb(Status::BAD_VALUE, 0, "invalid destination type"); + return Void(); } ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(), legacyMode, legacyPattern, srcPtr, legacySubSamples, |