commit 4b7a7c353ec67f183de65bd9b5eeeaa154c3ec0a
author Jeff Tinker <jtinker@google.com> Tue Jul 24 14:13:13 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu Aug 16 01:23:17 2018 +0000
tree abc8dfbc6da32133efdc70376503d9cbb8bdcdd0
parent 68287747beb438a15ed6dffefbd7844ac34eae7d

Fix information disclosure in mediadrmserver

Test:POC provided in bug
Bug:79218474
Change-Id: Iba12c07a5e615f8ed234b01ac53e3559ba9ac12e
(cherry picked from commit c1bf68a8d1321d7cdf7da6933f0b89b171d251c6)

drm/libmediadrm/ICrypto.cpp

diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp
index 1d70a4e..ee5ea936 100644
--- a/drm/libmediadrm/ICrypto.cpp
+++ b/drm/libmediadrm/ICrypto.cpp
@@ -225,8 +225,13 @@
 
 void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
-    vector.insertAt((size_t)0, size);
-    data.read(vector.editArray(), size);
+    if (vector.insertAt((size_t)0, size) < 0) {
+        vector.clear();
+    }
+    if (data.read(vector.editArray(), size) != NO_ERROR) {
+        vector.clear();
+        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
+    }
 }
 
 void BnCrypto::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {