diff options
| author | Jeff Tinker <jtinker@google.com> | 2018-07-13 16:58:04 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-09-14 20:44:09 +0000 |
| commit | a98e94f367af466e0b544c0f8ca7a50b631f38af (patch) | |
| tree | 98f8c5ea790e78a0796b731662dcb2d45bb9bcce | |
| parent | 56eb678d82dc845520d10025d349c9b7609a4f3a (diff) | |
| download | av-a98e94f367af466e0b544c0f8ca7a50b631f38af.tar.gz | |
Fix information disclosure in mediadrmserver DO NOT MERGE
Test:POC provided in bug
Bug:79218474
Change-Id: Ida9323dc1939e3c6e9fffe302bc8284d181817a7
(cherry picked from commit ecb2df5bc0c13fc7d7370f27017178111cd7727e)
| -rw-r--r-- | media/libmedia/ICrypto.cpp | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp index 26dd2c95bf..0ccf169ecf 100644 --- a/media/libmedia/ICrypto.cpp +++ b/media/libmedia/ICrypto.cpp @@ -199,8 +199,13 @@ IMPLEMENT_META_INTERFACE(Crypto, "android.hardware.ICrypto"); void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const { uint32_t size = data.readInt32(); - vector.insertAt((size_t)0, size); - data.read(vector.editArray(), size); + if (vector.insertAt((size_t)0, size) < 0) { + vector.clear(); + } + if (data.read(vector.editArray(), size) != NO_ERROR) { + vector.clear(); + android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0); + } } void BnCrypto::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const { |