commit 5137d519a0774d1e7eecb1caa19b1989c22b52c8
author Bill Yi <byi@google.com> Mon Apr 12 09:28:11 2021 -0700
committer Bill Yi <byi@google.com> Mon Apr 12 09:28:11 2021 -0700
tree 3491f29fb062ab05a8f1a08dbd82b83e5ab52abc
parent 3d4bd3ef47f5c5ce3cb1486cee00cbc8d646dde2
parent 65b4e4b7bf84f1e3f1f7b191a8a2971bbbb7cb3c

Merge RQ2A.210405.006 to stage-aosp-master - DO NOT MERGE

Merged-In: Ia79a4a3189a84591d35ab2303d2e20be77a21efa
Change-Id: I4901e127f503239c93fd7d296867a2fc7bee8c58

drm/1.0/default/CryptoPlugin.cpp

diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 2db3607..e6d4e84 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -124,7 +124,11 @@
             return Void();
         }
 
-        if (source.offset + offset + source.size > sourceBase->getSize()) {
+        size_t totalSize = 0;
+        if (__builtin_add_overflow(source.offset, offset, &totalSize) ||
+            __builtin_add_overflow(totalSize, source.size, &totalSize) ||
+            totalSize > sourceBase->getSize()) {
+            android_errorWriteLog(0x534e4554, "176496160");
             _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
             return Void();
         }