Commit: 7f0714951555cf92df2fa3c85a0250be048948cb - frameworks-av (git)

frameworks/av

Commit MetaInfo

• Révision: 7f0714951555cf92df2fa3c85a0250be048948cb (tree)
• l'heure: 2020-02-07 08:18:05
• Auteur: Edwin Wong <edwinwong@goog...>
• Commiter: Anis Assi

Message de Log

[DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt

Fix destPtr was not pointing to destination raw pointer.

bug: 144506242

Test: sts

ANDROID_BUILD_TOP= ./android-sts/tools/sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Poc19_12#testPocBug_144506242

Change-Id: I9425baa21c82d5a5edf37c87989adbade0428b67
(cherry picked from commit dc4c427b2155a9928a7cdaac7c0a787dd9c8192d)

Change Summary

• modified: drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

Modification

--- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
+++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
@@ -106,6 +106,8 @@ Return<void> CryptoPlugin::decrypt(
         return Void();
     }
 
+    base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer()));
+
     if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
         _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
         return Void();