tree 6dcea3c802413b6a5e52a9a6c81ae5aedcf44f9d
parent 72127d72fac156603483e1f6f08522b0d6d54452
author Edwin Wong <edwinwong@google.com> 1611721520 -0800
committer android-build-team Robot <android-build-team-robot@google.com> 1612833767 +0000

Fix potential decrypt src pointer overflow.

There is a potential integer overflow to bypass the
source base size check in decrypt. The source pointer
can then point to the outside of the source buffer,
which could potentially leak arbitrary memory content
to destination pointer.

Test: sts-tradefed
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176496160#testPocBug_176496160

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-17649616064

Bug: 176496160
Bug: 176444786
Change-Id: Iea3dcd44d0f4f61de3288ed1e26d8bd5e39115d2
(cherry picked from commit 9bae1251cfbc6fde87896bf1264dd0bbded7c5e5)