commit b1256b7f292307b2254b7082953b742f4e5e5655
author android-build-team Robot <android-build-team-robot@google.com> Fri Feb 05 00:05:48 2021 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 05 00:05:48 2021 +0000
tree 0711ed677684c877bb1e25145fd7bb87c47dc070
parent cf0e945ac2a3014499613cc983e527d66e8cac73
parent 92d4d99b989363a8c566fb334a41fb9f97975fa1

Snap for 7124858 from 92d4d99b989363a8c566fb334a41fb9f97975fa1 to rvc-qpr3-release

Change-Id: I3ef20bb3176aa63b7698aa64a12f2fa38d91057d

drm/1.0/default/CryptoPlugin.cpp

diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 2db3607..e6d4e84 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -124,7 +124,11 @@
             return Void();
         }
 
-        if (source.offset + offset + source.size > sourceBase->getSize()) {
+        size_t totalSize = 0;
+        if (__builtin_add_overflow(source.offset, offset, &totalSize) ||
+            __builtin_add_overflow(totalSize, source.size, &totalSize) ||
+            totalSize > sourceBase->getSize()) {
+            android_errorWriteLog(0x534e4554, "176496160");
             _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
             return Void();
         }