From fa237c4f76b7b9369d9c499bfdc81e5072ddde86 Mon Sep 17 00:00:00 2001 From: Edwin Wong Date: Wed, 27 Nov 2019 10:46:17 -0800 Subject: [DO NOT MERGE] Fix heap buffer overflow for releaseSecureStops. If the input SecureStopRelease size is less than sizeof(uint32_t) in releaseSecureStops(), an out of bound read will occur. bug: 144766455 bug: 144746235 bug: 147281068 Test: sts ANDROID_BUILD_TOP= ./android-sts/tools/sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Poc19_11#testPocBug_144766455 Change-Id: Ieccdd86ad86966fbf1dde70d3b3fb73d6dd124a4 --- drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drm') diff --git a/drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp index 71bb2185bd..aab475ed88 100644 --- a/drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp +++ b/drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp @@ -818,6 +818,12 @@ Return DrmPlugin::releaseSecureStops(const SecureStopRelease& ssRelease) // and the drm service. The clearkey implementation consists of: // count - number of secure stops // list of fixed length secure stops + size_t countBufferSize = sizeof(uint32_t); + if (input.size() < countBufferSize) { + // SafetyNet logging + android_errorWriteLog(0x534e4554, "144766455"); + return Status::BAD_VALUE; + } uint32_t count = 0; sscanf(reinterpret_cast(input.data()), "%04" PRIu32, &count); -- cgit v1.2.3