Index: content/renderer/media/android/renderer_media_player_manager.cc |
diff --git a/content/renderer/media/android/renderer_media_player_manager.cc b/content/renderer/media/android/renderer_media_player_manager.cc |
index f94185f5cad643aa7c48b599334265cce960937b..4767b17aaadb8bfcb37d217ef78ddb72987b119b 100644 |
--- a/content/renderer/media/android/renderer_media_player_manager.cc |
+++ b/content/renderer/media/android/renderer_media_player_manager.cc |
@@ -12,6 +12,13 @@ |
#include "content/renderer/media/android/webmediaplayer_android.h" |
#include "ui/gfx/rect_f.h" |
+// Maximum sizes for various EME message parameters. These are checks to |
+// prevent unnecessarily large messages from being passed around, and the sizes |
+// are somewhat arbitrary as the EME specification doesn't specify any limits. |
+static const size_t kEmeWebSessionIdMaximum = 512; |
+static const size_t kEmeMessageMaximum = 10240; // 10 KB |
+static const size_t kEmeDestinationUrlMaximum = 2048; // 2 KB |
+ |
namespace content { |
RendererMediaPlayerManager::RendererMediaPlayerManager(RenderView* render_view) |
@@ -57,11 +64,11 @@ bool RendererMediaPlayerManager::OnMessageReceived(const IPC::Message& msg) { |
IPC_MESSAGE_HANDLER(MediaPlayerMsg_DidExitFullscreen, OnDidExitFullscreen) |
IPC_MESSAGE_HANDLER(MediaPlayerMsg_DidMediaPlayerPlay, OnPlayerPlay) |
IPC_MESSAGE_HANDLER(MediaPlayerMsg_DidMediaPlayerPause, OnPlayerPause) |
- // TODO(jrummell): Update IPC names for EME WD and add Closed. |
- IPC_MESSAGE_HANDLER(MediaKeysMsg_KeyAdded, OnSessionReady) |
- IPC_MESSAGE_HANDLER(MediaKeysMsg_KeyError, OnSessionError) |
- IPC_MESSAGE_HANDLER(MediaKeysMsg_KeyMessage, OnSessionMessage) |
- IPC_MESSAGE_HANDLER(MediaKeysMsg_SetSessionId, OnSessionCreated) |
+ IPC_MESSAGE_HANDLER(MediaKeysMsg_SessionCreated, OnSessionCreated) |
+ IPC_MESSAGE_HANDLER(MediaKeysMsg_SessionMessage, OnSessionMessage) |
+ IPC_MESSAGE_HANDLER(MediaKeysMsg_SessionReady, OnSessionReady) |
+ IPC_MESSAGE_HANDLER(MediaKeysMsg_SessionClosed, OnSessionClosed) |
+ IPC_MESSAGE_HANDLER(MediaKeysMsg_SessionError, OnSessionError) |
IPC_MESSAGE_UNHANDLED(handled = false) |
IPC_END_MESSAGE_MAP() |
return handled; |
@@ -233,26 +240,26 @@ void RendererMediaPlayerManager::InitializeCDM(int media_keys_id, |
routing_id(), media_keys_id, uuid, frame_url)); |
} |
-void RendererMediaPlayerManager::GenerateKeyRequest( |
+void RendererMediaPlayerManager::CreateSession( |
int media_keys_id, |
uint32 session_id, |
const std::string& type, |
const std::vector<uint8>& init_data) { |
- Send(new MediaKeysHostMsg_GenerateKeyRequest( |
+ Send(new MediaKeysHostMsg_CreateSession( |
routing_id(), media_keys_id, session_id, type, init_data)); |
} |
-void RendererMediaPlayerManager::AddKey(int media_keys_id, |
- uint32 session_id, |
- const std::vector<uint8>& key, |
- const std::vector<uint8>& init_data) { |
- Send(new MediaKeysHostMsg_AddKey( |
- routing_id(), media_keys_id, session_id, key, init_data)); |
+void RendererMediaPlayerManager::UpdateSession( |
+ int media_keys_id, |
+ uint32 session_id, |
+ const std::vector<uint8>& response) { |
+ Send(new MediaKeysHostMsg_UpdateSession( |
+ routing_id(), media_keys_id, session_id, response)); |
} |
-void RendererMediaPlayerManager::CancelKeyRequest(int media_keys_id, |
- uint32 session_id) { |
- Send(new MediaKeysHostMsg_CancelKeyRequest( |
+void RendererMediaPlayerManager::ReleaseSession(int media_keys_id, |
+ uint32 session_id) { |
+ Send(new MediaKeysHostMsg_ReleaseSession( |
routing_id(), media_keys_id, session_id)); |
} |
@@ -260,6 +267,12 @@ void RendererMediaPlayerManager::OnSessionCreated( |
int media_keys_id, |
uint32 session_id, |
const std::string& web_session_id) { |
+ if (web_session_id.length() > kEmeWebSessionIdMaximum) { |
+ OnSessionError( |
+ media_keys_id, session_id, media::MediaKeys::kUnknownError, 0); |
+ return; |
+ } |
+ |
ProxyMediaKeys* media_keys = GetMediaKeys(media_keys_id); |
if (media_keys) |
media_keys->OnSessionCreated(session_id, web_session_id); |
@@ -270,6 +283,17 @@ void RendererMediaPlayerManager::OnSessionMessage( |
uint32 session_id, |
const std::vector<uint8>& message, |
const std::string& destination_url) { |
+ if (message.size() > kEmeMessageMaximum) { |
+ OnSessionError( |
+ media_keys_id, session_id, media::MediaKeys::kUnknownError, 0); |
+ return; |
+ } |
+ if (destination_url.length() > kEmeDestinationUrlMaximum) { |
+ OnSessionError( |
+ media_keys_id, session_id, media::MediaKeys::kUnknownError, 0); |
+ return; |
+ } |
+ |
ProxyMediaKeys* media_keys = GetMediaKeys(media_keys_id); |
if (media_keys) |
media_keys->OnSessionMessage(session_id, message, destination_url); |