diff options
| author | Jeff Tinker <jtinker@google.com> | 2019-10-16 10:25:23 -0700 |
|---|---|---|
| committer | Robert Shih <robertshih@google.com> | 2020-03-04 20:32:24 +0000 |
| commit | 8e3f56b7f281a775620a9a502384cc4d87d63dfc (patch) | |
| tree | 82c6a3c44feacf7699cd80b3e02d5bcebb57b53d /drm | |
| parent | 4f74cca0d45df6af3027aa218f3d23c3ee36a451 (diff) | |
| download | frameworks_av-8e3f56b7f281a775620a9a502384cc4d87d63dfc.tar.gz frameworks_av-8e3f56b7f281a775620a9a502384cc4d87d63dfc.tar.bz2 frameworks_av-8e3f56b7f281a775620a9a502384cc4d87d63dfc.zip | |
clearkey default: parsePssh securely
Bug: 137282168
Bug: 137370379
Test: drmpoc
Change-Id: Ic20a99b6b9fc661ead769217f88960571b5f68ad
Merged-In: Ic20a99b6b9fc661ead769217f88960571b5f68ad
(cherry picked from commit 1531cddad7c603fb530d1109463a1e8c03d515ff)
Diffstat (limited to 'drm')
| -rw-r--r-- | drm/mediadrm/plugins/clearkey/default/InitDataParser.cpp | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/drm/mediadrm/plugins/clearkey/default/InitDataParser.cpp b/drm/mediadrm/plugins/clearkey/default/InitDataParser.cpp index caff3939be..121a4e2952 100644 --- a/drm/mediadrm/plugins/clearkey/default/InitDataParser.cpp +++ b/drm/mediadrm/plugins/clearkey/default/InitDataParser.cpp @@ -76,10 +76,21 @@ android::status_t InitDataParser::parse(const Vector<uint8_t>& initData, android::status_t InitDataParser::parsePssh(const Vector<uint8_t>& initData, Vector<const uint8_t*>* keyIds) { + // Description of PSSH format: + // https://w3c.github.io/encrypted-media/format-registry/initdata/cenc.html size_t readPosition = 0; - // Validate size field uint32_t expectedSize = initData.size(); + const char psshIdentifier[4] = {'p', 's', 's', 'h'}; + const uint8_t psshVersion1[4] = {1, 0, 0, 0}; + uint32_t keyIdCount = 0; + size_t headerSize = sizeof(expectedSize) + sizeof(psshIdentifier) + + sizeof(psshVersion1) + kSystemIdSize + sizeof(keyIdCount); + if (initData.size() < headerSize) { + return android::ERROR_DRM_CANNOT_HANDLE; + } + + // Validate size field expectedSize = htonl(expectedSize); if (memcmp(&initData[readPosition], &expectedSize, sizeof(expectedSize)) != 0) { @@ -88,7 +99,6 @@ android::status_t InitDataParser::parsePssh(const Vector<uint8_t>& initData, readPosition += sizeof(expectedSize); // Validate PSSH box identifier - const char psshIdentifier[4] = {'p', 's', 's', 'h'}; if (memcmp(&initData[readPosition], psshIdentifier, sizeof(psshIdentifier)) != 0) { return android::ERROR_DRM_CANNOT_HANDLE; @@ -96,7 +106,6 @@ android::status_t InitDataParser::parsePssh(const Vector<uint8_t>& initData, readPosition += sizeof(psshIdentifier); // Validate EME version number - const uint8_t psshVersion1[4] = {1, 0, 0, 0}; if (memcmp(&initData[readPosition], psshVersion1, sizeof(psshVersion1)) != 0) { return android::ERROR_DRM_CANNOT_HANDLE; @@ -110,12 +119,14 @@ android::status_t InitDataParser::parsePssh(const Vector<uint8_t>& initData, readPosition += kSystemIdSize; // Read key ID count - uint32_t keyIdCount; memcpy(&keyIdCount, &initData[readPosition], sizeof(keyIdCount)); keyIdCount = ntohl(keyIdCount); readPosition += sizeof(keyIdCount); - if (readPosition + ((uint64_t)keyIdCount * kKeyIdSize) != - initData.size() - sizeof(uint32_t)) { + + uint64_t psshSize = 0; + if (__builtin_mul_overflow(keyIdCount, kKeyIdSize, &psshSize) || + __builtin_add_overflow(readPosition, psshSize, &psshSize) || + psshSize != initData.size() - sizeof(uint32_t) /* DataSize(0) */) { return android::ERROR_DRM_CANNOT_HANDLE; } |