diff options
| author | James Dong <jdong@google.com> | 2012-03-14 10:43:18 -0700 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2012-03-14 10:43:18 -0700 |
| commit | 8e3fac28a0326c060c01f5cdcfaf36cc995f3d19 (patch) | |
| tree | 5dfada04c653231dcccbb5db062727fa49039566 | |
| parent | 2bab6b63c758a892f5906198687c48b65e55debf (diff) | |
| parent | 32d8fc8d6d77eef02077142feb8bd9c7ee2cbe8f (diff) | |
| download | frameworks_base-8e3fac28a0326c060c01f5cdcfaf36cc995f3d19.zip frameworks_base-8e3fac28a0326c060c01f5cdcfaf36cc995f3d19.tar.gz frameworks_base-8e3fac28a0326c060c01f5cdcfaf36cc995f3d19.tar.bz2 | |
Merge "Fixed a buffer overflow bug in DrmPassthruPlugin"
| -rw-r--r-- | drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp index 33e723d..a3eac3e 100644 --- a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp +++ b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp @@ -279,8 +279,14 @@ status_t DrmPassthruPlugIn::onDecrypt(int uniqueId, DecryptHandle* decryptHandle * memory has to be allocated by the caller. */ if (NULL != (*decBuffer) && 0 < (*decBuffer)->length) { - memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length); - (*decBuffer)->length = encBuffer->length; + if ((*decBuffer)->length >= encBuffer->length) { + memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length); + (*decBuffer)->length = encBuffer->length; + } else { + ALOGE("decBuffer size (%d) too small to hold %d bytes", + (*decBuffer)->length, encBuffer->length); + return DRM_ERROR_UNKNOWN; + } } return DRM_NO_ERROR; } |