widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Bounds Check to initDataResemblesPSSH

Browse Source 
am: ce01000c1b

Change-Id: Ia40ae99bc17f2006901ca2cd91054a9ae3768a59
This commit is contained in:
John W. Bruce
2017-06-30 01:10:11 +00:00
committed by android-build-merger
parent ee41ad8b01 ce01000c1b
commit c48711d0ff
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
View File

@@ -1005,6 +1005,11 @@ status_t WVDrmPlugin::mapOEMCryptoResult(OEMCryptoResult res) {
bool WVDrmPlugin::initDataResemblesPSSH(const Vector<uint8_t>& initData) {
const uint8_t* const initDataArray = initData.array();
if (sizeof(uint32_t) + kPsshTag.size() > initData.size()) {
// The init data is so small that it couldn't contain a size and PSSH tag.
return false;
}
// Extract the size field
const uint8_t* const sizeField = &initDataArray[0];
uint32_t nboSize;

5
libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
View File

@@ -1312,6 +1312,11 @@ status_t WVDrmPlugin::mapOEMCryptoResult(OEMCryptoResult res) {
bool WVDrmPlugin::initDataResemblesPSSH(const std::vector<uint8_t>& initData) {
const uint8_t* const initDataArray = initData.data();
if (sizeof(uint32_t) + kPsshTag.size() > initData.size()) {
// The init data is so small that it couldn't contain a size and PSSH tag.
return false;
}
// Extract the size field
const uint8_t* const sizeField = &initDataArray[0];
uint32_t nboSize;