am 99e63e75: Merge "Fix for security vulnerability in media server DO NOT MERGE" into lmp-dev
* commit '99e63e75b670aeca1b4af401cb9582ba9fddf64d':
Fix for security vulnerability in media server DO NOT MERGE
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 7bd120e..0d68ee7 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -255,7 +255,28 @@
}
AString errorDetailMsg;
- ssize_t result = decrypt(
+ ssize_t result;
+
+ size_t sumSubsampleSizes = 0;
+ bool overflow = false;
+ for (int32_t i = 0; i < numSubSamples; ++i) {
+ CryptoPlugin::SubSample &ss = subSamples[i];
+ if (sumSubsampleSizes <= SIZE_MAX - ss.mNumBytesOfEncryptedData) {
+ sumSubsampleSizes += ss.mNumBytesOfEncryptedData;
+ } else {
+ overflow = true;
+ }
+ if (sumSubsampleSizes <= SIZE_MAX - ss.mNumBytesOfClearData) {
+ sumSubsampleSizes += ss.mNumBytesOfClearData;
+ } else {
+ overflow = true;
+ }
+ }
+
+ if (overflow || sumSubsampleSizes != totalSize) {
+ result = -EINVAL;
+ } else {
+ result = decrypt(
secure,
key,
iv,
@@ -264,6 +285,7 @@
subSamples, numSubSamples,
secure ? secureBufferId : dstPtr,
&errorDetailMsg);
+ }
reply->writeInt32(result);