commit 51aa2003766aa35d6c6b3ee688a86e117c65b94d
author Robert Shih <robertshih@google.com> Tue Feb 04 17:23:58 2020 -0800
committer Robert Shih <robertshih@google.com> Wed Feb 05 18:56:51 2020 +0000
tree b13d91733897c04147f067dfd9d9b68a69de0f37
parent efd8f9e09a1333e85802e855bd15ceca8948baed

BnCrypto: fix use-before-init in CREATE_PLUGIN

Bug: 144767096
Test: poc_ICrypto_283
Change-Id: Icd57367f8d912ff0a0cf9067c732b8fce169f29d
Merged-In: Id67dc9e793ee886e4cc49370d800c7f3580df313

drm/libmediadrm/ICrypto.cpp

diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp
index ee5ea93..fe94044 100644
--- a/drm/libmediadrm/ICrypto.cpp
+++ b/drm/libmediadrm/ICrypto.cpp
@@ -264,8 +264,12 @@
         {
             CHECK_INTERFACE(ICrypto, data, reply);
 
-            uint8_t uuid[16];
-            data.read(uuid, sizeof(uuid));
+            uint8_t uuid[16] = {0};
+            if (data.read(uuid, sizeof(uuid)) != NO_ERROR) {
+                android_errorWriteLog(0x534e4554, "144767096");
+                reply->writeInt32(BAD_VALUE);
+                return OK;
+            }
 
             size_t opaqueSize = data.readInt32();
             void *opaqueData = NULL;
@@ -281,6 +285,11 @@
             }
 
             data.read(opaqueData, opaqueSize);
+            if (data.read(opaqueData, opaqueSize) != NO_ERROR) {
+                android_errorWriteLog(0x534e4554, "144767096");
+                reply->writeInt32(BAD_VALUE);
+                return OK;
+            }
             reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize));
 
             free(opaqueData);