The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.
SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.
The crash was reproduced on the device before the fix.
Verified the test passes after the fix.
Test: sts
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-176495665_sts64
Bug: 176495665
Bug: 176444161
Change-Id: Ie1aca0ceacb4b7a1b6e473b823541607a36d8cb4
There is a potential integer overflow to bypass the
destination base size check in decrypt. The destPtr
can then point to the outside of the destination buffer.
Test: sts-tradefed
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176444622#testPocBug_176444622
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-17644462264
Bug: 176444622
Bug: 176496353
Change-Id: Id3aece61d46d548c304782d4e1dc3a4747795c01
Merged-In: Id3aece61d46d548c304782d4e1dc3a4747795c01
Merged from http://go/wvgerrit/114903
There is a potential integer overflow to bypass the
source base size check in decrypt. The source pointer
can then point to the outside of the source buffer,
which could potentially leak arbitrary memory content
to destination pointer.
Test: sts-tradefed
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176496160#testPocBug_176496160
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-17649616064
Bug: 176496160
Bug: 176444786
Change-Id: I208e0d5d949e8ef003fcf7d6f129eab66b9b3656
[ Merge of http://go/wvgerrit/79883 ]
This corrects test code and undoes CE CDM changes in b/113167010 which
will be resolved in a future release.
The tests failures addressed are
* ProvisioningTestWithServiceCertificate
* ReleaseRetryOfflineKeyTest
* ReleaseRetryL3OfflineKeyTest
* ReleaseRetryL3OfflineKeySessionUsageDisable
ProvisioningInterspersedRetryTest has been disabled and will be
addressed in a post 15.2 OEMCrypto release in 133641240
Bug: 119428680
Test: WV unit/integration tests
Change-Id: I7961b4556a0ac749e4f38d43f1bea8f520d67f20
[ Merge of http://go/wvgerrit/80084 ]
Corrected the key type being returned after entitled keys from
init data are loaded. Made test changes to validate.
Bug: 133903028
Test: WV unit/integration tests
Change-Id: Icb44587f5c3aba3b0facae6d83dc9344d6b60833
Bug: b/133427576
Test: Unit tests on Taimen and Crosshatch
Merge of http://go/wvgerrit/79804
Currently, the run_all_unit_tests.sh script fails to load in the Level 1
OEMCrypto for some devices that don't have a 64-bit liboemcrypto.so. This
is because the liboemcrypto.so tries to load in libQSEEComAPI.so, which
some devices contain both a 32-bit and 64-bit version of. Since we set
the LD_LIBRARY_PATH to use /vendor/lib64 first, and since we only have a
32-bit liboemcrypto.so, the 32-bit liboemcrypto.so will try to load in the
libQSEEComAPI.so in the lib64 path first. Since the liboemcrypto.so is
32-bit, it will fail to open the 64-bit library. The solution to this is
to conditionally set the LD_LIBRARY_PATH based on if a 64-bit
liboemcrypto.so exists or not.
Change-Id: I80a9e778f31f089f66df0544cb022d810e9d3de3
Bug: b/130252305
Test: nyc-mr2-release -> pi-dev, oc-mr1-release -> pi-dev
nyc-mr2-release -> oc-mr1-release -> pi-dev upgrades with offline
licenses
Merge of http://go/ag/7323341
In N, the L3 files were stored in /data/mediadrm/IDM[uid]/. In O, they
were moved to /data/mediadrm/IDM[uid]/L3/. In P, we moved the contents
of mediadrm to /data/vendor/mediadrm/. For an O->P upgrade, the L3 files
can be read in /data/vendor/mediadrm/IDM[uid]/L3/, but when we upgrade
N->P, the L3 files sit in /data/vendor/mediadrm/IDM[uid]/, unable to be
read. This CL addresses this issue by changing the script to move any L3
files if they exist under this directory to the L3 subdirectory after we
do the bulk move from /data/mediadrm/ to /data/vendor/mediadrm/.
Change-Id: I319c323879766df063d25478046367878023a7cf
(cherry picked from commit 1a6ca36976)
Merge from Widevine repo of http://go/wvgerrit/78949
LoadKeyWithSuspiciousIV is a new test for OEMCrypto v15.2. It is
being disabled since we do not require 15.2 for the Q release.
SelectKeyNotThereAPI15 was failing because the error code is
delayed. This is acceptable.
Bug: 132720732
Test: unit tests on taimen
Change-Id: Iea3fabfb3afd800065119ce812fb454be1e82644
[ Merge of http://go/wvgerrit/78763 ]
The android timer instance is held by a regular pointer rather
than reference counted as all classes that derive from RefBase
should be. This could result in a double deallocation, if the
timer is ever passed to a strong pointer.
Bug: 79364026
Test: WV unit/integration tests. GtsMediaTestCases. Play movies
playback tests.
Change-Id: I01f622bc045e1012f2240b3775a6d121f9415463
[ Merge of http://go/wvgerrit/77506 ]
Callers of MediaDrm can register to be notified when key status
changes and if they are usable for decryption. A number of factors
are evaluated when making this determination. Key container security
level will now be included in the evaluation.
Bug: 78652608
Test: WV unit/integration test, GtsMediaDrmTest, Play movies playback
testing.
Change-Id: I20243e5cb160f7957e3239e8d05f715ff0ee6dd6
Merge from Widevine repo of http://go/wvgerrit/78623
This updates the license request client identification to include
OEMCrypto build information.
Bug: 129070445
Test: ExoPlayer on crosshatch with mod mock
Change-Id: I0dbce0cca4e9810e14f60561e4e434f1dbcadfb6
Merge from Widevine repo of http://go/wvgerrit/77609
For v15.2 we require that nonces not collide across sessions and there are
restrictions placed on the mac key's IV in LoadKeys.
Test: ran unit tests on reference code
Bug: 131325434
Bug: 131326334
Change-Id: I1bb01c30d8c15d66d762c28b57d7700c44daa835
(This is a merge of http://go/wvgerrit/78105)
The Widevine Android CDM should not allow itself to be instantiated
without an app package name, as this breaks SPOID protection.
Unfortunately, pathways exist prior to Android Q that allow this to
happen, and we cannot break these devices by changing the behavior now.
As such, we will only refuse to allow instantiation without an app
package name on devices first launched with Q and later.
This change also migrates the WVDrmFactory and its tests away from
explicitly naming friend classes for individual test, in favor of the
now-recommended "test peer" pattern.
Bug: 65680731
Test: libwvdrmengine_hidl_test
Test: CTS NativeMediaDrmClearkeyTest
Change-Id: Icccd1d8b9972ef6ad7e5b0dbf2d37ec987656385
Merge from Widevine repo of http://go/wvgerrit/78143
This verifies that the correct mac keys are used to sign a message when
generating a usage report or secure stop.
Test: unit tests on ref code and taimen
Bug: 111261264
Change-Id: I7d56a6ff0aae68a5554f7ce84d467697d1f9997b
