From 51aa2003766aa35d6c6b3ee688a86e117c65b94d Mon Sep 17 00:00:00 2001 From: Robert Shih Date: Tue, 4 Feb 2020 17:23:58 -0800 Subject: BnCrypto: fix use-before-init in CREATE_PLUGIN Bug: 144767096 Test: poc_ICrypto_283 Change-Id: Icd57367f8d912ff0a0cf9067c732b8fce169f29d Merged-In: Id67dc9e793ee886e4cc49370d800c7f3580df313 --- drm/libmediadrm/ICrypto.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'drm') diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp index ee5ea936c4..fe94044875 100644 --- a/drm/libmediadrm/ICrypto.cpp +++ b/drm/libmediadrm/ICrypto.cpp @@ -264,8 +264,12 @@ status_t BnCrypto::onTransact( { CHECK_INTERFACE(ICrypto, data, reply); - uint8_t uuid[16]; - data.read(uuid, sizeof(uuid)); + uint8_t uuid[16] = {0}; + if (data.read(uuid, sizeof(uuid)) != NO_ERROR) { + android_errorWriteLog(0x534e4554, "144767096"); + reply->writeInt32(BAD_VALUE); + return OK; + } size_t opaqueSize = data.readInt32(); void *opaqueData = NULL; @@ -281,6 +285,11 @@ status_t BnCrypto::onTransact( } data.read(opaqueData, opaqueSize); + if (data.read(opaqueData, opaqueSize) != NO_ERROR) { + android_errorWriteLog(0x534e4554, "144767096"); + reply->writeInt32(BAD_VALUE); + return OK; + } reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize)); free(opaqueData); -- cgit v1.2.3