Check for crypto size overflow
Bug: 111922341
Test: build
Change-Id: Icfe2d15c13f1b4bb77e0a9684ffc1284f557e6d5
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerDrm.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerDrm.cpp
index bde0862..8d876da 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerDrm.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerDrm.cpp
@@ -239,8 +239,14 @@
size_t *encryptedbytes)
{
// size needed to store all the crypto data
- size_t cryptosize = sizeof(CryptoInfo) +
- sizeof(CryptoPlugin::SubSample) * numSubSamples;
+ size_t cryptosize;
+ // sizeof(CryptoInfo) + sizeof(CryptoPlugin::SubSample) * numSubSamples;
+ if (__builtin_mul_overflow(sizeof(CryptoPlugin::SubSample), numSubSamples, &cryptosize) ||
+ __builtin_add_overflow(cryptosize, sizeof(CryptoInfo), &cryptosize)) {
+ ALOGE("crypto size overflow");
+ return NULL;
+ }
+
CryptoInfo *ret = (CryptoInfo*) malloc(cryptosize);
if (ret == NULL) {
ALOGE("couldn't allocate %zu bytes", cryptosize);