widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Part of fix for libmedia OOB write anywhere

Browse Source 
Prevent usage of client provided address on
non-secure devices spoofed as being secure.

b/23223325

merge of go/wvgerrit/15420 from widevine repo

Change-Id: I1d4f3a652b3d5e78fca508f92005cfa8df5ec6db
This commit is contained in:
Jeff Tinker
2015-08-17 17:56:27 -07:00
parent 9a714edc6f
commit 1319c43361
3 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
libwvdrmengine/cdm/core/include/wv_cdm_types.h
View File

@@ -202,6 +202,7 @@ enum CdmResponseType {
LICENSE_REQUEST_NONCE_GENERATION_ERROR, LICENSE_REQUEST_NONCE_GENERATION_ERROR,
LICENSE_REQUEST_SIGNING_ERROR, LICENSE_REQUEST_SIGNING_ERROR,
EMPTY_LICENSE_REQUEST, EMPTY_LICENSE_REQUEST,
SECURE_BUFFER_REQUIRED,
}; };
enum CdmKeyStatus { enum CdmKeyStatus {

4
libwvdrmengine/cdm/core/src/crypto_session.cpp
View File

@@ -641,6 +641,10 @@ CdmResponseType CryptoSession::Decrypt(const CdmDecryptionParameters& params) {
buffer_descriptor.type = buffer_descriptor.type =
params.is_secure ? destination_buffer_type_ : OEMCrypto_BufferType_Clear; params.is_secure ? destination_buffer_type_ : OEMCrypto_BufferType_Clear;
if (params.is_secure && buffer_descriptor.type == OEMCrypto_BufferType_Clear) {
return SECURE_BUFFER_REQUIRED;
}
switch (buffer_descriptor.type) { switch (buffer_descriptor.type) {
case OEMCrypto_BufferType_Clear: case OEMCrypto_BufferType_Clear:
buffer_descriptor.buffer.clear.address = buffer_descriptor.buffer.clear.address =

2
libwvdrmengine/include/mapErrors-inl.h
View File

@@ -345,6 +345,8 @@ static android::status_t mapCdmResponseType(wvcdm::CdmResponseType res) {
return android::ERROR_DRM_UNKNOWN; return android::ERROR_DRM_UNKNOWN;
case wvcdm::UNUSED_1: case wvcdm::UNUSED_1:
return android::UNKNOWN_ERROR; return android::UNKNOWN_ERROR;
case wvcdm::SECURE_BUFFER_REQUIRED:
return android::ERROR_DRM_CANNOT_HANDLE;
} }
// Return here instead of as a default case so that the compiler will warn // Return here instead of as a default case so that the compiler will warn