Snap for 7306623 from 8c0769d8a9 to sc-release

Change-Id: I3c3dc56e17f2fa821dc66de52fd1bb88cd0594cc
2021-04-23 01:18:40 +00:00
parent 0e74d6c8a7 8c0769d8a9
commit c58beefc0d
1 changed files with 4 additions and 1 deletions
--- a/libwvdrmengine/mediacrypto/src_hidl/WVCryptoPlugin.cpp
+++ b/libwvdrmengine/mediacrypto/src_hidl/WVCryptoPlugin.cpp
@@ -233,7 +233,10 @@ Return<void> WVCryptoPlugin::decrypt_1_2(
      return Void();
    }

-    if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
+    size_t totalDstSize = 0;
+    if (__builtin_add_overflow(destBuffer.offset, destBuffer.size, &totalDstSize) ||
+        totalDstSize > destBase->getSize()) {
+      android_errorWriteLog(0x534e4554, "176444622");
      _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size");
      return Void();
    }