diff options
| author | mspector@google.com <mspector@google.com> | 2016-02-08 10:56:13 -0800 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-03-01 15:25:30 -0800 |
| commit | 52fbd46e2b7bc185628e94178cc3ec8e2a340b40 (patch) | |
| tree | d0dadf288043a882b6e364c6ad6a10b5939e3b90 | |
| parent | 9dacf2727c5919faea7cc103eeedfceceeff83b6 (diff) | |
| download | frameworks_av-52fbd46e2b7bc185628e94178cc3ec8e2a340b40.zip frameworks_av-52fbd46e2b7bc185628e94178cc3ec8e2a340b40.tar.gz frameworks_av-52fbd46e2b7bc185628e94178cc3ec8e2a340b40.tar.bz2 | |
IOMX.cpp uninitialized pointer in BnOMX::onTransact
This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning
Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
| -rw-r--r-- | media/libmedia/IOMX.cpp | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp index 5423c2a..8f55eb9 100644 --- a/media/libmedia/IOMX.cpp +++ b/media/libmedia/IOMX.cpp @@ -446,7 +446,7 @@ public: remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply); status_t err = reply.readInt32(); - if (sidebandHandle) { + if (err == OK && sidebandHandle) { *sidebandHandle = (native_handle_t *)reply.readNativeHandle(); } return err; @@ -948,11 +948,13 @@ status_t BnOMX::onTransact( OMX_BOOL tunneled = (OMX_BOOL)data.readInt32(); OMX_U32 audio_hw_sync = data.readInt32(); - native_handle_t *sideband_handle; + native_handle_t *sideband_handle = NULL; status_t err = configureVideoTunnelMode( node, port_index, tunneled, audio_hw_sync, &sideband_handle); reply->writeInt32(err); - reply->writeNativeHandle(sideband_handle); + if(err == OK){ + reply->writeNativeHandle(sideband_handle); + } return NO_ERROR; } |