commit d651cdcfafd48df0ae0f50f83eb85a35ee5ab0cb
author Edwin Wong <edwinwong@google.com> Thu Jan 23 20:59:59 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Jan 23 20:59:59 2020 +0000
tree 2926078ecc63d88d598b6e1541c9a267dbdf6596
parent 2587ab6c7642062ea1791de1868c28b1164a073c
parent dc4c427b2155a9928a7cdaac7c0a787dd9c8192d

Merge "[DO NOT MERGE] Fix heap buffer overflow in clearkey CryptoPlugin::decrypt" into pi-dev

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
index 198e099..cd2224d 100644
--- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
+++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
@@ -106,6 +106,8 @@
         return Void();
     }
 
+    base = static_cast<uint8_t *>(static_cast<void *>(destBase->getPointer()));
+
     if (destBuffer.offset + destBuffer.size > destBase->getSize()) {
         _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
         return Void();