commit 1d48298d6933e61f5f163ba92afe4bee0fb9b1f5
author Chad Brubaker <cbrubaker@google.com> Thu Mar 05 19:53:35 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Mar 05 19:53:35 2015 +0000
tree f136568de40380f2fa0931b1478c683ca5141425
parent 8529cadc46150bc9bddc2844653f0eb5d253b148
parent c451fe041c7c67cb111948c9c615b0cd99830d6a

am c451fe04: (-s ours) am 056ef407: am b060ae05: Merge "Revert "Add Keymaster 0.4 binder methods""

* commit 'c451fe041c7c67cb111948c9c615b0cd99830d6a':
  Revert "Add Keymaster 0.4 binder methods"

keystore/IKeystoreService.cpp

diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index 53788bd..2ab4ac4 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -29,6 +29,8 @@
 
 namespace android {
 
+const ssize_t MAX_GENERATE_ARGS = 3;
+
 KeystoreArg::KeystoreArg(const void* data, size_t len)
     : mData(data), mSize(len) {
 }
@@ -772,6 +774,9 @@
             int32_t argsPresent = data.readInt32();
             if (argsPresent == 1) {
                 ssize_t numArgs = data.readInt32();
+                if (numArgs > MAX_GENERATE_ARGS) {
+                    return BAD_VALUE;
+                }
                 if (numArgs > 0) {
                     for (size_t i = 0; i < (size_t) numArgs; i++) {
                         ssize_t inSize = data.readInt32();

keystore/keystore.cpp

diff --git a/keystore/keystore.cpp b/keystore/keystore.cpp
index 194b87c..a35063f 100644
--- a/keystore/keystore.cpp
+++ b/keystore/keystore.cpp
@@ -504,6 +504,7 @@
 public:
     Blob(const uint8_t* value, int32_t valueLength, const uint8_t* info, uint8_t infoLength,
             BlobType type) {
+        memset(&mBlob, 0, sizeof(mBlob));
         mBlob.length = valueLength;
         memcpy(mBlob.value, value, valueLength);
 
@@ -524,7 +525,9 @@
         mBlob = b;
     }
 
-    Blob() {}
+    Blob() {
+        memset(&mBlob, 0, sizeof(mBlob));
+    }
 
     const uint8_t* getValue() const {
         return mBlob.value;