Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into sc-dev

2021-04-21 23:16:47 +00:00
parent 347bba5261 68b5b00567
commit 8c0769d8a9
1 changed files with 4 additions and 1 deletions
--- a/libwvdrmengine/mediacrypto/src_hidl/WVCryptoPlugin.cpp
+++ b/libwvdrmengine/mediacrypto/src_hidl/WVCryptoPlugin.cpp
@@ -233,7 +233,10 @@ Return<void> WVCryptoPlugin::decrypt_1_2(
      return Void();
    }

-    if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
+    size_t totalDstSize = 0;
+    if (__builtin_add_overflow(destBuffer.offset, destBuffer.size, &totalDstSize) ||
+        totalDstSize > destBase->getSize()) {
+      android_errorWriteLog(0x534e4554, "176444622");
      _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size");
      return Void();
    }