mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
50 lines
2.4 KiB
Diff
50 lines
2.4 KiB
Diff
|
From 41235bcc67a2122bc1d6a4d19e8356b3d1ada91e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Kyle Zhang <kelzhan@google.com>
|
||
|
|
Date: Fri, 10 Mar 2023 00:06:16 +0000
|
||
|
|
Subject: [PATCH] Fix mSession NULL dereference
|
||
|
|
|
||
|
|
Bug: 230793853
|
||
|
|
Test: clearkeyV1.4_fuzzer
|
||
|
|
Change-Id: I3f11b133a4854a9ef896c9f5042bd719527c3fa6
|
||
|
|
---
|
||
|
|
drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp | 3 +++
|
||
|
|
drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 4 ++++
|
||
|
|
2 files changed, 7 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp
|
||
|
|
index afc9b6a9a4..a63471fd53 100644
|
||
|
|
--- a/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp
|
||
|
|
+++ b/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp
|
||
|
|
@@ -137,6 +137,8 @@ ::ndk::ScopedAStatus CryptoPlugin::decrypt(const DecryptArgs& in_args, int32_t*
|
||
|
|
*_aidl_return = static_cast<ssize_t>(offset);
|
||
|
|
return toNdkScopedAStatus(Status::OK);
|
||
|
|
} else if (in_args.mode == Mode::AES_CTR) {
|
||
|
|
+ if (!mSession) return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE,
|
||
|
|
+ "session not found");
|
||
|
|
size_t bytesDecrypted{};
|
||
|
|
std::vector<int32_t> clearDataLengths;
|
||
|
|
std::vector<int32_t> encryptedDataLengths;
|
||
|
|
@@ -149,6 +151,7 @@ ::ndk::ScopedAStatus CryptoPlugin::decrypt(const DecryptArgs& in_args, int32_t*
|
||
|
|
detailedError = "invalid decrypt parameter size";
|
||
|
|
return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, detailedError);
|
||
|
|
}
|
||
|
|
+
|
||
|
|
auto res =
|
||
|
|
mSession->decrypt(in_args.keyId.data(), in_args.iv.data(),
|
||
|
|
srcPtr, static_cast<uint8_t*>(destPtr),
|
||
|
|
diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
|
||
|
|
index 7bc320db6b..64a43b0af7 100644
|
||
|
|
--- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
|
||
|
|
+++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
|
||
|
|
@@ -211,6 +211,10 @@ Return<void> CryptoPlugin::decrypt_1_2(
|
||
|
|
_hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "invalid decrypt parameter size");
|
||
|
|
return Void();
|
||
|
|
}
|
||
|
|
+ if (!mSession) {
|
||
|
|
+ _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "session not found");
|
||
|
|
+ return Void();
|
||
|
|
+ }
|
||
|
|
Status_V1_2 res = mSession->decrypt(keyId.data(), iv.data(), srcPtr,
|
||
|
|
static_cast<uint8_t*>(destPtr), toVector(subSamples), &bytesDecrypted);
|
||
|
|
if (res == Status_V1_2::OK) {
|