commit fdfb9d206d2d8e5c58c3175064bff33ce562cbc6
author Jeff Tinker <jtinker@google.com> Tue Jun 06 19:34:01 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jun 06 19:34:01 2017 +0000
tree 9736b6313a887e18d386893e01fc8a09bc8b9684
parent f86cad799d95edf551616083c25e929847aaa61b
parent 1248e62082d04ece6963ee421791650f0887be59

Fix integer overflow in mediadrmserver am: eb21712f81 am: 5250bc1bec am: d1a854a073 am: 7a22df06c3 am: 4e339cbca4
am: 1248e62082

Change-Id: If8396602c2c92f2e3c97e73a2da6a338ec17131d

drm/mediadrm/plugins/clearkey/InitDataParser.cpp

diff --git a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
index c22d73a..c9c2a38 100644
--- a/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
+++ b/drm/mediadrm/plugins/clearkey/InitDataParser.cpp
@@ -109,7 +109,7 @@
     memcpy(&keyIdCount, &initData[readPosition], sizeof(keyIdCount));
     keyIdCount = ntohl(keyIdCount);
     readPosition += sizeof(keyIdCount);
-    if (readPosition + (keyIdCount * kKeyIdSize) !=
+    if (readPosition + ((uint64_t)keyIdCount * kKeyIdSize) !=
             initData.size() - sizeof(uint32_t)) {
         return android::ERROR_DRM_CANNOT_HANDLE;
     }