diff options
| author | Edwin Wong <edwinwong@google.com> | 2019-12-17 17:01:59 -0800 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2020-02-11 19:06:52 +0000 |
| commit | bcd4eaae518a8185726fd440fca9e3b6eee6a1ff (patch) | |
| tree | 5f046524cc57102c64356af7e83fdd16c8160839 /drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | |
| parent | fe8b9a7cb32f739e3855c51c8803590908a1da9c (diff) | |
| download | frameworks_av-bcd4eaae518a8185726fd440fca9e3b6eee6a1ff.tar.gz frameworks_av-bcd4eaae518a8185726fd440fca9e3b6eee6a1ff.tar.bz2 frameworks_av-bcd4eaae518a8185726fd440fca9e3b6eee6a1ff.zip | |
[DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt
Fix destPtr was not pointing to destination raw pointer.
bug: 144506242
Test: sts
ANDROID_BUILD_TOP= ./android-sts/tools/sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Poc19_12#testPocBug_144506242
Change-Id: Ia1b8f755daaada2f1411abeb3cb5b832a72b3c82
(cherry picked from commit 8464bfa975afe360bb8e3dd59c036ce4a4995fa8)
Diffstat (limited to 'drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp')
| -rw-r--r-- | drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp index f164f2859b..3ecf6d5acd 100644 --- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp +++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp @@ -136,6 +136,8 @@ Return<void> CryptoPlugin::decrypt_1_2( return Void(); } + base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer())); + if (destBuffer.offset + destBuffer.size > destBase->getSize()) { _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size"); return Void(); |