commit 9667e3eff2d34c3797c3b529370de47b2c1f1bf6
author Marco Nelissen <marcone@google.com> Mon Feb 06 14:12:30 2017 -0800
committer Marco Nelissen <marcone@google.com> Mon Feb 06 22:31:24 2017 +0000
tree cddf3b6ae1401bed68a831c735c71319340447cc
parent fdf64bab960ec1d0effab8dd8ea67e46d120a45b

Fix overflow check and check read result

Bug: 33861560
Test: build
Change-Id: Ia85519766e19a6e37237166f309750b3e8323c4e

media/libmedia/IHDCP.cpp

diff --git a/media/libmedia/IHDCP.cpp b/media/libmedia/IHDCP.cpp
index 9d93320..1e2cddb 100644
--- a/media/libmedia/IHDCP.cpp
+++ b/media/libmedia/IHDCP.cpp
@@ -241,14 +241,11 @@
         case HDCP_ENCRYPT:
         {
             size_t size = data.readInt32();
-            size_t bufSize = 2 * size;
-
-            // watch out for overflow
             void *inData = NULL;
-            if (bufSize > size) {
-                inData = malloc(bufSize);
+            // watch out for overflow
+            if (size <= SIZE_MAX / 2) {
+                inData = malloc(2 * size);
             }
-
             if (inData == NULL) {
                 reply->writeInt32(ERROR_OUT_OF_RANGE);
                 return OK;
@@ -256,11 +253,16 @@
 
             void *outData = (uint8_t *)inData + size;
 
-            data.read(inData, size);
+            status_t err = data.read(inData, size);
+            if (err != OK) {
+                free(inData);
+                reply->writeInt32(err);
+                return OK;
+            }
 
             uint32_t streamCTR = data.readInt32();
             uint64_t inputCTR;
-            status_t err = encrypt(inData, size, streamCTR, &inputCTR, outData);
+            err = encrypt(inData, size, streamCTR, &inputCTR, outData);
 
             reply->writeInt32(err);