commit 75979dc147c4d2f832730da2e9b68d93ce892ba3
author James Dong <jdong@google.com> Wed Mar 14 10:43:18 2012 -0700
committer Android (Google) Code Review <android-gerrit@google.com> Wed Mar 14 10:43:18 2012 -0700
tree b26fb398fb90419a003547ec3a08157440acc48b
parent edc8a8e6054d67b22ec27d62f0abfdafafd66b76
parent 35250664455c9642cc14d3831b663880637a7d70

Merge "Fixed a buffer overflow bug in DrmPassthruPlugin"

drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp

diff --git a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
index 33e723d..a3eac3e 100644
--- a/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
+++ b/drm/libdrmframework/plugins/passthru/src/DrmPassthruPlugIn.cpp
@@ -279,8 +279,14 @@
      * memory has to be allocated by the caller.
      */
     if (NULL != (*decBuffer) && 0 < (*decBuffer)->length) {
-        memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length);
-        (*decBuffer)->length = encBuffer->length;
+        if ((*decBuffer)->length >= encBuffer->length) {
+            memcpy((*decBuffer)->data, encBuffer->data, encBuffer->length);
+            (*decBuffer)->length = encBuffer->length;
+        } else {
+            ALOGE("decBuffer size (%d) too small to hold %d bytes",
+                (*decBuffer)->length, encBuffer->length);
+            return DRM_ERROR_UNKNOWN;
+        }
     }
     return DRM_NO_ERROR;
 }