commit 9cb76c120169b52713e89ec37eb24c3166074d04
author Edwin Wong <edwinwong@google.com> Thu Jan 23 20:58:30 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Jan 23 20:58:30 2020 +0000
tree 002f8e2cd4ec01207b3f2dd9219eca0e96ea901c
parent 338209bb2f4cd5d0e4feea97d8003193102e17eb
parent 591f24cd32db96acffab727a3c6363d9fe203fdd

Merge "Fix heap buffer overflow in clearkey CryptoPlugin::decrypt"

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
index f164f28..3ecf6d5 100644
--- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
+++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
@@ -136,6 +136,8 @@
         return Void();
     }
 
+    base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer()));
+
     if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
         _hidl_cb(Status_V1_2::ERROR_DRM_FRAME_TOO_LARGE, 0, "invalid buffer size");
         return Void();