diff options
author | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2017-05-02 19:21:00 +0200 |
---|---|---|
committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2017-05-02 19:21:00 +0200 |
commit | eca582052ef000897f69d6d0bdd96c7a8aa59cda (patch) | |
tree | 7472d8773c4bb9321fdd41d0aef057e30045e557 /media/libmedia/IHDCP.cpp | |
parent | 26718276fd99ef60d9646d79467d2bb3f2db5549 (diff) | |
parent | dc7805b0c79d056385a076422894425984af2aa0 (diff) | |
download | frameworks_av-9a9c0238da053badb1e57a1e0c62e65e5960b4d0.zip frameworks_av-9a9c0238da053badb1e57a1e0c62e65e5960b4d0.tar.gz frameworks_av-9a9c0238da053badb1e57a1e0c62e65e5960b4d0.tar.bz2 |
Merge branch 'cm-13.0' of https://github.com/LineageOS/android_frameworks_av into replicant-6.0HEADreplicant-6.0-0001replicant-6.0
Diffstat (limited to 'media/libmedia/IHDCP.cpp')
-rw-r--r-- | media/libmedia/IHDCP.cpp | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/media/libmedia/IHDCP.cpp b/media/libmedia/IHDCP.cpp index f3a8902..e8c8a3d 100644 --- a/media/libmedia/IHDCP.cpp +++ b/media/libmedia/IHDCP.cpp @@ -241,14 +241,11 @@ status_t BnHDCP::onTransact( case HDCP_ENCRYPT: { size_t size = data.readInt32(); - size_t bufSize = 2 * size; - - // watch out for overflow void *inData = NULL; - if (bufSize > size) { - inData = malloc(bufSize); + // watch out for overflow + if (size <= SIZE_MAX / 2) { + inData = malloc(2 * size); } - if (inData == NULL) { reply->writeInt32(ERROR_OUT_OF_RANGE); return OK; @@ -256,11 +253,16 @@ status_t BnHDCP::onTransact( void *outData = (uint8_t *)inData + size; - data.read(inData, size); + status_t err = data.read(inData, size); + if (err != OK) { + free(inData); + reply->writeInt32(err); + return OK; + } uint32_t streamCTR = data.readInt32(); uint64_t inputCTR; - status_t err = encrypt(inData, size, streamCTR, &inputCTR, outData); + err = encrypt(inData, size, streamCTR, &inputCTR, outData); reply->writeInt32(err); |