commit 2921de78e6a7df365ed806cf4b98193862a97807
author Jeff Tinker <jtinker@google.com> Wed Oct 18 21:47:38 2017 +0000
committer android-build-merger <android-build-merger@google.com> Wed Oct 18 21:47:38 2017 +0000
tree 983a10fa24e422ae2648ca089278120e575ef6fc
parent 0f471b957302ce90ea0635ef2d59ff6df347bb5b
parent 650e3e6325c63dadb6bd14b8a13bc73ce1ec0990

Fix information disclosure in mediadrmserver am: b41a527176 am: 70dc77cc94 am: e41b49b5ea am: 470e03a10b am: d1e097f456 am: 32ae22ff0f am: 4e55c5aae0 am: 88e846c4e7 am: acfb40f741 am: e2f8930c39 am: b3a0e4680b am: 3cf728e758
am: 650e3e6325

Change-Id: I9109b02acf15f7498523569e432141da23edd6c6

drm/libmediadrm/IDrm.cpp

diff --git a/drm/libmediadrm/IDrm.cpp b/drm/libmediadrm/IDrm.cpp
index 4e47112..8ff6e6a 100644
--- a/drm/libmediadrm/IDrm.cpp
+++ b/drm/libmediadrm/IDrm.cpp
@@ -561,8 +561,13 @@
 
 void BnDrm::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
-    vector.insertAt((size_t)0, size);
-    data.read(vector.editArray(), size);
+    if (vector.insertAt((size_t)0, size) < 0) {
+        vector.clear();
+    }
+    if (data.read(vector.editArray(), size) != NO_ERROR) {
+        vector.clear();
+        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
+    }
 }
 
 void BnDrm::writeVector(Parcel *reply, Vector<uint8_t> const &vector) const {