diff options
author | Jeff Tinker <jtinker@google.com> | 2018-01-11 00:14:53 -0800 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-01-18 19:07:26 +0000 |
commit | 871412cfa05770cfd8be0a130b68386775445057 (patch) | |
tree | 18db7142cdadef6b21d109022cf606af566c7bb3 | |
parent | 41c800b90de31114108a985e5d11ba94a45fcd78 (diff) | |
download | av-871412cfa05770cfd8be0a130b68386775445057.tar.gz |
Fix potential buffer overflow in mediadrmserver
bug:71389378
test: gts media tests
Change-Id: Ic7d4b456bc874b92fbe202e3dafb7ceac747ebc7
(cherry picked from commit 5231cc164fe040a3ab5fcb28baae4e0a4f9fdf4c)
-rw-r--r-- | drm/libmediadrm/ICrypto.cpp | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp index 8506d95c0f..37dc83bb8b 100644 --- a/drm/libmediadrm/ICrypto.cpp +++ b/drm/libmediadrm/ICrypto.cpp @@ -16,14 +16,14 @@ //#define LOG_NDEBUG 0 #define LOG_TAG "ICrypto" -#include <utils/Log.h> - #include <binder/Parcel.h> #include <binder/IMemory.h> +#include <cutils/log.h> #include <media/ICrypto.h> #include <media/stagefright/MediaErrors.h> #include <media/stagefright/foundation/ADebug.h> #include <media/stagefright/foundation/AString.h> +#include <utils/Log.h> namespace android { @@ -362,6 +362,13 @@ status_t BnCrypto::onTransact( reply->writeInt32(BAD_VALUE); return OK; } + sp<IMemory> dest = destination.mSharedMemory; + if (totalSize > dest->size() || + (size_t)dest->offset() > dest->size() - totalSize) { + reply->writeInt32(BAD_VALUE); + android_errorWriteLog(0x534e4554, "71389378"); + return OK; + } } AString errorDetailMsg; |