Bug with cipher of SimpleCache on Android 4.3

[ZuZuK]

Issue description

Crash on closing CipherStream that is using in SimpleCache (Android 4.3 only).
Where is a problem: com/google/android/exoplayer2/upstream/cache/CachedContentIndex.java:90
Google similar issue: https://issuetracker.google.com/issues/36976726
Possible cause: https://android-developers.googleblog.com/2013/12/changes-to-secretkeyfactory-api-in.html

Reproduction steps

Can't reproduce - just have some reports from Crashlytics

Link to test content

Can't test :(

Version of ExoPlayer being used

r2.3.1

Device(s) and version(s) of Android being used

Android 4.3 devices

A full bug report captured from the device

java.lang.RuntimeException: error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length
       at org.apache.harmony.xnet.provider.jsse.NativeCrypto.EVP_CipherFinal_ex(NativeCrypto.java)
       at org.apache.harmony.xnet.provider.jsse.OpenSSLCipher.doFinalInternal(OpenSSLCipher.java:398)
       at org.apache.harmony.xnet.provider.jsse.OpenSSLCipher.engineDoFinal(OpenSSLCipher.java:434)
       at javax.crypto.Cipher.doFinal(Cipher.java:1049)
       at javax.crypto.CipherInputStream.close(CipherInputStream.java:175)
       at java.io.FilterInputStream.close(FilterInputStream.java:64)
       at com.google.android.exoplayer2.util.Util.closeQuietly(Util.java:231)
       at com.google.android.exoplayer2.upstream.cache.CachedContentIndex.readFile(CachedContentIndex.java:273)
       at com.google.android.exoplayer2.upstream.cache.SimpleCache$1.com.google.android.exoplayer2.upstream.cache.CachedContentIndex.load(SimpleCache.java:2107)

[ojw28]

I tried this on a Nexus 7 running Android 4.3 and the crash does not reproduce. I suspect you have more information about the affected devices, for example device model numbers, exact builds of Android 4.3, and possibly device fingerprints (which contain both of these together with additional useful information). Please can you provide this information, if you have it?

Also, what % of user devices are you seeing this issue on? Are you sure it's not just happening on devices that have been unlocked and flashed with some random unofficial/broken Android build?

[ZuZuK]

very rare case. we have 76 affected users. it's much less than 1% of auditory

maybe you are right that it's broken Android. especially cause 23% of affected devices are rooted

[ojw28]

I'm not convinced you can't drill down further into the devices. "samsung" isn't enough information to do anything useful with. Can you not get actual device models, build numbers etc?

[ZuZuK]

@ojw28 latest 300 crashes by devices

sorry can't do more - don't see option to upload all info from crashlytics so had to do it manually crash-by-crash :(

[ojw28]

Heh, thanks for the info. Looking at the SCH-I535 and SM-N900S specifically, can you see what the exact Android OS build is on those devices, or the full device fingerprint (this is much more specific than just "4.3"). Thanks.

[ZuZuK]

Nope, sorry - crashlytics doesn't log such info. maybe I could add OS build number as custom key lately. but it will be only on next release (need few weeks)

can only say that it is russian market so maybe there is some info from manufactorers about build number of OS on their devices by country

[ojw28]

@erdemguven - Unsure if there's anything actionable here at this point, but if there's anything obvious we can do, it might be worthwhile :).

[yvlad]

Using BouncyCastle provider for AES/CBC/PKCS5PADDING cipher totally fixed issue.
I am using this code snippet to create Cipher in CachedContentIndex now:

  @NonNull
  private Cipher createCipher() throws NoSuchPaddingException, NoSuchAlgorithmException {
    if (Build.VERSION.SDK_INT == Build.VERSION_CODES.JELLY_BEAN_MR2) {
      // https://issuetracker.google.com/issues/36976726
      // https://github.com/google/ExoPlayer/issues/2755
      try {
        return Cipher.getInstance("AES/CBC/PKCS5PADDING", "BC");
      } catch (final NoSuchProviderException ignored) {
        // ignored
      } catch (final NoSuchPaddingException ignored) {
        // ignored
      } catch (final NoSuchAlgorithmException ignored) {
        // ignored
      }
    }
    return Cipher.getInstance("AES/CBC/PKCS5PADDING");
  }

[ojw28]

That's a great find; thanks. @erdemguven - Let's merge an equivalent change?

[ojw28]

This is fixed in dev-v2, and will be in r2.5.3, which will be released some time this week.