commit 28bfa10673ae0bef2b9500214510e2beb0d506fd
author Andres Morales <anmorales@google.com> Mon Apr 13 17:42:21 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Mon Apr 13 17:42:21 2015 +0000
tree 9ece73e057e227558d546d017fde861b20fc729d
parent 87f0b385a188db1df285c0ce820b7e2ab43e1e1c
parent 38beb106f37034c32298f258e07cddf3ce377fcd

am 38beb106: am a11517f6: am 00300a11: Merge "Fix addAuthToken api"

* commit '38beb106f37034c32298f258e07cddf3ce377fcd':
  Fix addAuthToken api

keystore/IKeystoreService.cpp

diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index d58f5ec..855790e 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -30,6 +30,7 @@
 
 namespace android {
 
+const ssize_t MAX_GENERATE_ARGS = 3;
 static keymaster_key_param_t* readParamList(const Parcel& in, size_t* length);
 
 KeystoreArg::KeystoreArg(const void* data, size_t len)
@@ -1418,6 +1419,9 @@
             int32_t argsPresent = data.readInt32();
             if (argsPresent == 1) {
                 ssize_t numArgs = data.readInt32();
+                if (numArgs > MAX_GENERATE_ARGS) {
+                    return BAD_VALUE;
+                }
                 if (numArgs > 0) {
                     for (size_t i = 0; i < (size_t) numArgs; i++) {
                         ssize_t inSize = data.readInt32();

keystore/keystore.cpp

diff --git a/keystore/keystore.cpp b/keystore/keystore.cpp
index a65a34c..2d3a431 100644
--- a/keystore/keystore.cpp
+++ b/keystore/keystore.cpp
@@ -501,6 +501,7 @@
 public:
     Blob(const uint8_t* value, int32_t valueLength, const uint8_t* info, uint8_t infoLength,
             BlobType type) {
+        memset(&mBlob, 0, sizeof(mBlob));
         mBlob.length = valueLength;
         memcpy(mBlob.value, value, valueLength);
 
@@ -521,7 +522,9 @@
         mBlob = b;
     }
 
-    Blob() {}
+    Blob() {
+        memset(&mBlob, 0, sizeof(mBlob));
+    }
 
     const uint8_t* getValue() const {
         return mBlob.value;