summaryrefslogtreecommitdiffstats
path: root/drm/libdrmframework
diff options
context:
space:
mode:
authorJames Dong <jdong@google.com>2012-03-14 10:43:18 -0700
committerAndroid (Google) Code Review <android-gerrit@google.com>2012-03-14 10:43:18 -0700
commit75979dc147c4d2f832730da2e9b68d93ce892ba3 (patch)
treeb26fb398fb90419a003547ec3a08157440acc48b /drm/libdrmframework
parentedc8a8e6054d67b22ec27d62f0abfdafafd66b76 (diff)
parent35250664455c9642cc14d3831b663880637a7d70 (diff)
downloadframeworks_av-75979dc147c4d2f832730da2e9b68d93ce892ba3.zip
frameworks_av-75979dc147c4d2f832730da2e9b68d93ce892ba3.tar.gz
frameworks_av-75979dc147c4d2f832730da2e9b68d93ce892ba3.tar.bz2
Merge "Fixed a buffer overflow bug in DrmPassthruPlugin"
Diffstat (limited to 'drm/libdrmframework')
-rw-r--r--drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp10
1 files changed, 8 insertions, 2 deletions
diff --git a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
index 33e723d..a3eac3e 100644
--- a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
+++ b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
@@ -279,8 +279,14 @@ status_t DrmPassthruPlugIn::onDecrypt(int uniqueId, DecryptHandle* decryptHandle
* memory has to be allocated by the caller.
*/
if (NULL != (*decBuffer) && 0 < (*decBuffer)->length) {
- memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length);
- (*decBuffer)->length = encBuffer->length;
+ if ((*decBuffer)->length >= encBuffer->length) {
+ memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length);
+ (*decBuffer)->length = encBuffer->length;
+ } else {
+ ALOGE("decBuffer size (%d) too small to hold %d bytes",
+ (*decBuffer)->length, encBuffer->length);
+ return DRM_ERROR_UNKNOWN;
+ }
}
return DRM_NO_ERROR;
}