diff options
Diffstat (limited to 'media/libmedia/IMediaPlayer.cpp')
-rw-r--r-- | media/libmedia/IMediaPlayer.cpp | 41 |
1 files changed, 35 insertions, 6 deletions
diff --git a/media/libmedia/IMediaPlayer.cpp b/media/libmedia/IMediaPlayer.cpp index 20bc23d4f7..eaa2e6363b 100644 --- a/media/libmedia/IMediaPlayer.cpp +++ b/media/libmedia/IMediaPlayer.cpp @@ -20,6 +20,7 @@ #include <sys/types.h> #include <android/IDataSource.h> +#include <binder/IPCThreadState.h> #include <binder/Parcel.h> #include <gui/IGraphicBufferProducer.h> #include <media/AudioResamplerPublic.h> @@ -82,10 +83,36 @@ enum { }; // ModDrm helpers -static void readVector(const Parcel& reply, Vector<uint8_t>& vector) { - uint32_t size = reply.readUint32(); - vector.insertAt((size_t)0, size); - reply.read(vector.editArray(), size); +static status_t readVector(const Parcel& reply, Vector<uint8_t>& vector) { + uint32_t size = 0; + status_t status = reply.readUint32(&size); + if (status == OK) { + status = size <= reply.dataAvail() ? OK : BAD_VALUE; + } + if (status == OK) { + status = vector.insertAt((size_t) 0, size) >= 0 ? OK : NO_MEMORY; + } + if (status == OK) { + status = reply.read(vector.editArray(), size); + } + if (status != OK) { + char errorMsg[100]; + char buganizerId[] = "173720767"; + snprintf(errorMsg, + sizeof(errorMsg), + "%s: failed to read array. Size: %d, status: %d.", + __func__, + size, + status); + android_errorWriteWithInfoLog( + /* safetyNet tag= */ 0x534e4554, + buganizerId, + IPCThreadState::self()->getCallingUid(), + errorMsg, + strlen(errorMsg)); + ALOGE("%s (b/%s)", errorMsg, buganizerId); + } + return status; } static void writeVector(Parcel& data, Vector<uint8_t> const& vector) { @@ -961,8 +988,10 @@ status_t BnMediaPlayer::onTransact( uint8_t uuid[16]; data.read(uuid, sizeof(uuid)); Vector<uint8_t> drmSessionId; - readVector(data, drmSessionId); - + status_t status = readVector(data, drmSessionId); + if (status != OK) { + return status; + } uint32_t result = prepareDrm(uuid, drmSessionId); reply->writeInt32(result); return OK; |