68b5b0056721217d70106c08b0b99384de18385f
sc-dev branch is missing this fix, it did not auto merge from http://ag/13617980 There is a potential integer overflow to bypass the destination base size check in decrypt. The destPtr can then point to the outside of the destination buffer. Test: sts-tradefed sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176444622#testPocBug_176444622 Test: push to device with target_hwasan-userdebug build adb shell /data/local/tmp/Bug-17644462264 Bug: 176444622 Bug: 176496353 Change-Id: I88fff54de09d6753672b2a46c029960b5c30f5e7
Description
No description provided