commit 2ce897bc22fefdf44c682c9e61ed4880ee9e08b7
author Jeff Tinker <jtinker@google.com> Fri Jul 13 16:58:04 2018 -0700
committer Ryan Longair <rlongair@google.com> Tue Aug 21 12:58:00 2018 -0700
tree 7755753c69ab5f9357f75925414201cce2017d9a
parent f4a995e6790f08010661993d1fac51638be7be7c

Fix information disclosure in mediadrmserver DO NOT MERGE

Test:POC provided in bug
Bug:79218474
Change-Id: Ida9323dc1939e3c6e9fffe302bc8284d181817a7
(cherry picked from commit ecb2df5bc0c13fc7d7370f27017178111cd7727e)

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 302e6ee..aa222c5 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -199,8 +199,13 @@
 
 void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
-    vector.insertAt((size_t)0, size);
-    data.read(vector.editArray(), size);
+    if (vector.insertAt((size_t)0, size) < 0) {
+        vector.clear();
+    }
+    if (data.read(vector.editArray(), size) != NO_ERROR) {
+        vector.clear();
+        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
+    }
 }
 
 void BnCrypto::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {