commit 1ce2364aa0b8115f91129983afda449fcabd46e9
author Jeff Tinker <jtinker@google.com> Tue Jun 06 19:57:41 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jun 06 19:57:41 2017 +0000
tree 365b7c9376d10a8643d1ef0f2bcf0781885222c0
parent a5d6111e686713262692fbd18d50477fd2591548
parent 8d214cd0b0b667b30b3f0f6021fcb5d7d95553d0

Fix integer overflow in mediadrmserver am: eb21712f81 am: 5250bc1bec am: d1a854a073 am: 7a22df06c3 am: 4e339cbca4 am: 1248e62082 am: fdfb9d206d am: a64aff4551 am: 87e076681b
am: 8d214cd0b0

Change-Id: I95ccb284cfa1afc9997279c307bd13d2e2387a77

drm/mediadrm/plugins/clearkey/InitDataParser.cpp

diff --git a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
index 0216b8d..6a4f8d5 100644
--- a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
+++ b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
@@ -114,7 +114,7 @@
     memcpy(&keyIdCount, &initData[readPosition], sizeof(keyIdCount));
     keyIdCount = ntohl(keyIdCount);
     readPosition += sizeof(keyIdCount);
-    if (readPosition + (keyIdCount * kKeyIdSize) !=
+    if (readPosition + ((uint64_t)keyIdCount * kKeyIdSize) !=
             initData.size() - sizeof(uint32_t)) {
         return android::ERROR_DRM_CANNOT_HANDLE;
     }