commit 470e03a10b3179a4c38e86b5ca99b8720c1a9a80
author Jeff Tinker <jtinker@google.com> Wed Oct 18 18:37:37 2017 +0000
committer android-build-merger <android-build-merger@google.com> Wed Oct 18 18:37:37 2017 +0000
tree d9d1e05aa9fc0ff48c72a532323a272782e98d9b
parent c52190750e73458016150e6dc969447d76e55ce5
parent e41b49b5ea0c881b5db04d74071bfddbc9bc388d

Fix information disclosure in mediadrmserver am: b41a527176 am: 70dc77cc94
am: e41b49b5ea

Change-Id: I535fa9de1021f3bb3042905275984d7fdc73baee

media/libmedia/IDrm.cpp

diff --git a/media/libmedia/IDrm.cpp b/media/libmedia/IDrm.cpp
index 6f6530b..637770d 100644
--- a/media/libmedia/IDrm.cpp
+++ b/media/libmedia/IDrm.cpp
@@ -572,8 +572,13 @@
 
 void BnDrm::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
-    vector.insertAt((size_t)0, size);
-    data.read(vector.editArray(), size);
+    if (vector.insertAt((size_t)0, size) < 0) {
+        vector.clear();
+    }
+    if (data.read(vector.editArray(), size) != NO_ERROR) {
+        vector.clear();
+        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
+    }
 }
 
 void BnDrm::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {