commit 70dc77cc94c285236e9fff50dbaefaf20b5528eb
author Jeff Tinker <jtinker@google.com> Tue Oct 10 19:02:45 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Oct 10 19:02:45 2017 +0000
tree 0b7001d779ffaa9ab927bb4c5c47ea87d29ec41f
parent 643dd1d8d4e8aa64dcefc7e4cfbd6c2486090e06
parent b41a527176b659c5ddfc734838df7607a6af80c9

Fix information disclosure in mediadrmserver
am: b41a527176

Change-Id: Iee7d26d93e639cc7b7e0bb3de8b788090822a609

media/libmedia/IDrm.cpp

diff --git a/media/libmedia/IDrm.cpp b/media/libmedia/IDrm.cpp
index 7e74de9..54e0878 100644
--- a/media/libmedia/IDrm.cpp
+++ b/media/libmedia/IDrm.cpp
@@ -476,8 +476,13 @@
 
 void BnDrm::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
-    vector.insertAt((size_t)0, size);
-    data.read(vector.editArray(), size);
+    if (vector.insertAt((size_t)0, size) < 0) {
+        vector.clear();
+    }
+    if (data.read(vector.editArray(), size) != NO_ERROR) {
+        vector.clear();
+        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
+    }
 }
 
 void BnDrm::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {