commit a0bc9057618c2befd0df5e19c8d144e80ea041da
author Jeff Tinker <jtinker@google.com> Thu Jan 11 00:14:53 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Thu Jan 18 19:41:46 2018 +0000
tree 1132ec1c9301c1315a46eff40e0efc2b8f2a96b9
parent 547514a8dee7c3b17ad5d0578a9ea6bdd6cfa89d

Fix potential buffer overflow in mediadrmserver

bug:71389378
test: gts media tests

Change-Id: Ic7d4b456bc874b92fbe202e3dafb7ceac747ebc7
(cherry picked from commit 5231cc164fe040a3ab5fcb28baae4e0a4f9fdf4c)

drm/libmediadrm/ICrypto.cpp

diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp
index 8506d95..37dc83b 100644
--- a/drm/libmediadrm/ICrypto.cpp
+++ b/drm/libmediadrm/ICrypto.cpp
@@ -16,14 +16,14 @@
 
 //#define LOG_NDEBUG 0
 #define LOG_TAG "ICrypto"
-#include <utils/Log.h>
-
 #include <binder/Parcel.h>
 #include <binder/IMemory.h>
+#include <cutils/log.h>
 #include <media/ICrypto.h>
 #include <media/stagefright/MediaErrors.h>
 #include <media/stagefright/foundation/ADebug.h>
 #include <media/stagefright/foundation/AString.h>
+#include <utils/Log.h>
 
 namespace android {
 
@@ -362,6 +362,13 @@
                     reply->writeInt32(BAD_VALUE);
                     return OK;
                 }
+                sp<IMemory> dest = destination.mSharedMemory;
+                if (totalSize > dest->size() ||
+                        (size_t)dest->offset() > dest->size() - totalSize) {
+                    reply->writeInt32(BAD_VALUE);
+                    android_errorWriteLog(0x534e4554, "71389378");
+                    return OK;
+                }
             }
 
             AString errorDetailMsg;