diff options
| author | Edwin Wong <edwinwong@google.com> | 2020-01-23 20:59:59 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-01-23 20:59:59 +0000 |
| commit | d651cdcfafd48df0ae0f50f83eb85a35ee5ab0cb (patch) | |
| tree | 2926078ecc63d88d598b6e1541c9a267dbdf6596 | |
| parent | 2587ab6c7642062ea1791de1868c28b1164a073c (diff) | |
| parent | dc4c427b2155a9928a7cdaac7c0a787dd9c8192d (diff) | |
| download | frameworks_av-d651cdcfafd48df0ae0f50f83eb85a35ee5ab0cb.tar.gz frameworks_av-d651cdcfafd48df0ae0f50f83eb85a35ee5ab0cb.tar.bz2 frameworks_av-d651cdcfafd48df0ae0f50f83eb85a35ee5ab0cb.zip | |
Merge "[DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt" into pi-dev
| -rw-r--r-- | drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp index 198e0997d0..cd2224db97 100644 --- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp +++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp @@ -106,6 +106,8 @@ Return<void> CryptoPlugin::decrypt( return Void(); } + base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer())); + if (destBuffer.offset + destBuffer.size > destBase->getSize()) { _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size"); return Void(); |