| Revisión | 61f5bf3b737e80875ca1166756df0997756cf606 (tree) |
|---|---|
| Tiempo | 2018-08-16 10:24:50 |
| Autor | android-build-team Robot <android-build-team-robot@goog...> |
| Commiter | android-build-team Robot |
Merge cherrypicks of [4787660, 4787680, 4787071, 4787700, 4787592, 4787701, 4787720, 4787721, 4787072, 4787073, 4787074, 4787075, 4787076, 4787077, 4787740, 4787760, 4787722, 4787723, 4787724, 4787725, 4787726, 4787727, 4787728, 4787729, 4787730, 4787731] into oc-m8-release
Change-Id: Ib832d8162af176e40f54cc889d1872cd6b88990b
drm/libmediadrm/ICrypto.cpp (diff) media/ndk/NdkMediaCodec.cpp (diff)| @@ -225,8 +225,13 @@ IMPLEMENT_META_INTERFACE(Crypto, "android.hardware.ICrypto"); | ||
| 225 | 225 | |
| 226 | 226 | void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const { |
| 227 | 227 | uint32_t size = data.readInt32(); |
| 228 | - vector.insertAt((size_t)0, size); | |
| 229 | - data.read(vector.editArray(), size); | |
| 228 | + if (vector.insertAt((size_t)0, size) < 0) { | |
| 229 | + vector.clear(); | |
| 230 | + } | |
| 231 | + if (data.read(vector.editArray(), size) != NO_ERROR) { | |
| 232 | + vector.clear(); | |
| 233 | + android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0); | |
| 234 | + } | |
| 230 | 235 | } |
| 231 | 236 | |
| 232 | 237 | void BnCrypto::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const { |
| @@ -553,7 +553,13 @@ AMediaCodecCryptoInfo *AMediaCodecCryptoInfo_new( | ||
| 553 | 553 | size_t *encryptedbytes) { |
| 554 | 554 | |
| 555 | 555 | // size needed to store all the crypto data |
| 556 | - size_t cryptosize = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2; | |
| 556 | + size_t cryptosize; | |
| 557 | + // = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2; | |
| 558 | + if (__builtin_mul_overflow(sizeof(size_t) * 2, numsubsamples, &cryptosize) || | |
| 559 | + __builtin_add_overflow(cryptosize, sizeof(AMediaCodecCryptoInfo), &cryptosize)) { | |
| 560 | + ALOGE("crypto size overflow"); | |
| 561 | + return NULL; | |
| 562 | + } | |
| 557 | 563 | AMediaCodecCryptoInfo *ret = (AMediaCodecCryptoInfo*) malloc(cryptosize); |
| 558 | 564 | if (!ret) { |
| 559 | 565 | ALOGE("couldn't allocate %zu bytes", cryptosize); |
Android-x86
Fork