commit 9d8247f151344097cc5a0c7b0255ba2527c8bed0
author Jeff Tinker <jtinker@google.com> Mon Jun 05 14:34:48 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jun 16 18:45:24 2017 +0000
tree 429c02bc5ab9a6ec413a11454bb188e43e263cd5
parent 19724bd388a11408faa523ce058d9207418cb0d8

Fix integer overflow in mediadrmserver

bug:37710346
Change-Id: If18cfb5bb1d1f1b2997d2a0e1685590d674181f4
(cherry picked from commit eb21712f81aa9f6d5b055113595220ee1506f35c)

drm/mediadrm/plugins/clearkey/InitDataParser.cpp

diff --git a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
index 0216b8d..6a4f8d5 100644
--- a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
+++ b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
@@ -114,7 +114,7 @@
     memcpy(&keyIdCount, &initData[readPosition], sizeof(keyIdCount));
     keyIdCount = ntohl(keyIdCount);
     readPosition += sizeof(keyIdCount);
-    if (readPosition + (keyIdCount * kKeyIdSize) !=
+    if (readPosition + ((uint64_t)keyIdCount * kKeyIdSize) !=
             initData.size() - sizeof(uint32_t)) {
         return android::ERROR_DRM_CANNOT_HANDLE;
     }