diff options
| author | Edwin Wong <edwinwong@google.com> | 2020-01-23 20:58:58 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-01-23 20:58:58 +0000 |
| commit | 5b4757c2bb4359b7272d3bb85e0613d07871ddac (patch) | |
| tree | 427f1b0bdf86ce803c1b84f12bafc828c42dcc28 /drm | |
| parent | 63a3347443eeb35d5f73bf13dd882d67c09d03bc (diff) | |
| parent | d81917505eda818d64135a8226a529b3901dee4b (diff) | |
| download | frameworks_av-5b4757c2bb4359b7272d3bb85e0613d07871ddac.tar.gz frameworks_av-5b4757c2bb4359b7272d3bb85e0613d07871ddac.tar.bz2 frameworks_av-5b4757c2bb4359b7272d3bb85e0613d07871ddac.zip | |
Merge "[DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt" into qt-dev
Diffstat (limited to 'drm')
| -rw-r--r-- | drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp index f164f2859b..3ecf6d5acd 100644 --- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp +++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp @@ -136,6 +136,8 @@ Return<void> CryptoPlugin::decrypt_1_2( return Void(); } + base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer())); + if (destBuffer.offset + destBuffer.size > destBase->getSize()) { _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size"); return Void(); |