commit fc62c64de1ac0c88453f2909d302f0a7f7aaf703
author Edwin Wong <edwinwong@google.com> Mon Apr 05 21:22:06 2021 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Apr 05 21:22:06 2021 +0000
tree 33f3a6299f89f35a8a98adff3a56e3c9beeae837
parent eca5c7182063a343c9e4b6b12dacb89dc4217f09
parent 9191787d0e73712608eff22fca9aea9480d4691e

Merge "Fix potential decrypt destPtr overflow." into rvc-dev

drm/1.0/default/CryptoPlugin.cpp

diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 8af190b..17a2f24 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -124,7 +124,11 @@
             return Void();
         }
 
-        if (source.offset + offset + source.size > sourceBase->getSize()) {
+        size_t totalSize = 0;
+        if (__builtin_add_overflow(source.offset, offset, &totalSize) ||
+            __builtin_add_overflow(totalSize, source.size, &totalSize) ||
+            totalSize > sourceBase->getSize()) {
+            android_errorWriteLog(0x534e4554, "176496160");
             _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
             return Void();
         }