commit 007064a8caae76cc17e883ece4c9f361cb6a7429
author Jeff Tinker <jtinker@google.com> Wed Dec 09 16:43:07 2015 -0800
committer android-build-merger <android-build-merger@google.com> Wed Dec 09 16:43:07 2015 -0800
tree 324fd5e36325198bc58058e842c194d2a3f1f873
parent eb030dc3656e57a5386902dc955bb5a24c8a2404
parent 3f05f30117c9ad8a0956f31431ddd5fbc07fbd99

Merge "Fix security vulnerability in ICrypto DO NOT MERGE" into mnc-dev am: 89bec04cf8 am: f797a48b4c
am: 3f05f30117

* commit '3f05f30117c9ad8a0956f31431ddd5fbc07fbd99':
  Fix security vulnerability in ICrypto DO NOT MERGE

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index a398ff7..22f8af7 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -321,7 +321,9 @@
 
             if (overflow || sumSubsampleSizes != totalSize) {
                 result = -EINVAL;
-            } else if (offset + totalSize > sharedBuffer->size()) {
+            } else if (totalSize > sharedBuffer->size()) {
+                result = -EINVAL;
+            } else if ((size_t)offset > sharedBuffer->size() - totalSize) {
                 result = -EINVAL;
             } else {
                 result = decrypt(