diff options
author | Hung Nguyen <hung.nguyen@sonymobile.com> | 2012-06-05 13:19:53 +0200 |
---|---|---|
committer | James Dong <jdong@google.com> | 2013-01-25 16:25:18 -0800 |
commit | 2d45dbd1910a7e51d383e8583017e6f26cd3498a (patch) | |
tree | 260d8bd329b3e2004f7fb995a4a21d32588252f8 /drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c | |
parent | 0bf43848adb00922122b0a0eed2fa0318bde8317 (diff) | |
download | frameworks_av-2d45dbd1910a7e51d383e8583017e6f26cd3498a.zip frameworks_av-2d45dbd1910a7e51d383e8583017e6f26cd3498a.tar.gz frameworks_av-2d45dbd1910a7e51d383e8583017e6f26cd3498a.tar.bz2 |
Fixed bugs where the content of buffer holding keys was cleared using a wrong size in forward lock
Modified by James Dong <jdong@google.com>
Change-Id: Iaacfc79b2b26bdee7046d8555e3b4e0bc224c3c5
Diffstat (limited to 'drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c')
-rw-r--r-- | drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c b/drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c index bb97abc..9d15835 100644 --- a/drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c +++ b/drm/libdrmframework/plugins/forward-lock/internal-format/converter/FwdLockConv.c @@ -245,7 +245,9 @@ static int FwdLockConv_DeriveKeys(FwdLockConv_Session_t *pSession) { AES_KEY sessionRoundKeys; unsigned char value[KEY_SIZE]; unsigned char key[KEY_SIZE]; - } *pData = malloc(sizeof *pData); + }; + const size_t kSize = sizeof(struct FwdLockConv_DeriveKeys_Data); + struct FwdLockConv_DeriveKeys_Data *pData = malloc(kSize); if (pData == NULL) { status = FwdLockConv_Status_OutOfMemory; } else { @@ -268,7 +270,7 @@ static int FwdLockConv_DeriveKeys(FwdLockConv_Session_t *pSession) { status = FwdLockConv_Status_OK; } } - memset(pData, 0, sizeof pData); // Zero out key data. + memset(pData, 0, kSize); // Zero out key data. free(pData); } return status; |