From 8464bfa975afe360bb8e3dd59c036ce4a4995fa8 Mon Sep 17 00:00:00 2001 From: Edwin Wong Date: Tue, 17 Dec 2019 17:01:59 -0800 Subject: [DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt Fix destPtr was not pointing to destination raw pointer. bug: 144506242 Test: sts ANDROID_BUILD_TOP= ./android-sts/tools/sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Poc19_12#testPocBug_144506242 Change-Id: Ia1b8f755daaada2f1411abeb3cb5b832a72b3c82 --- drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drm') diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp index f164f2859b..3ecf6d5acd 100644 --- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp +++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp @@ -136,6 +136,8 @@ Return CryptoPlugin::decrypt_1_2( return Void(); } + base = static_cast(static_cast(destBase->getPointer())); + if (destBuffer.offset + destBuffer.size > destBase->getSize()) { _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size"); return Void(); -- cgit v1.2.3