summaryrefslogtreecommitdiffstats
path: root/drm
diff options
context:
space:
mode:
authorJeff Tinker <jtinker@google.com>2015-09-16 18:48:13 +0000
committerAndroid Git Automerger <android-git-automerger@android.com>2015-09-16 18:48:13 +0000
commit8ba28c840589bcc7fa4dfcb26606748a0c0b7eb5 (patch)
treec8132b5a85be4d7cb54bbdeacf368d9f10a293fc /drm
parent9b547a24f340d20edd5a812ac8c8ce9b056d5adb (diff)
parentd61dbb36a673a8278eb7d63e53215b2cff804f4b (diff)
downloadframeworks_av-8ba28c840589bcc7fa4dfcb26606748a0c0b7eb5.zip
frameworks_av-8ba28c840589bcc7fa4dfcb26606748a0c0b7eb5.tar.gz
frameworks_av-8ba28c840589bcc7fa4dfcb26606748a0c0b7eb5.tar.bz2
am d61dbb36: am 38281f1c: am d386c5be: Merge "Fix heap data leak vulnerability" into klp-dev
* commit 'd61dbb36a673a8278eb7d63e53215b2cff804f4b': Fix heap data leak vulnerability
Diffstat (limited to 'drm')
-rw-r--r--drm/common/IDrmManagerService.cpp16
1 files changed, 10 insertions, 6 deletions
diff --git a/drm/common/IDrmManagerService.cpp b/drm/common/IDrmManagerService.cpp
index db41e0b..c235201 100644
--- a/drm/common/IDrmManagerService.cpp
+++ b/drm/common/IDrmManagerService.cpp
@@ -741,9 +741,11 @@ status_t BpDrmManagerService::decrypt(
const status_t status = reply.readInt32();
ALOGV("Return value of decrypt() is %d", status);
- const int size = reply.readInt32();
- (*decBuffer)->length = size;
- reply.read((void *)(*decBuffer)->data, size);
+ if (status == NO_ERROR) {
+ const int size = reply.readInt32();
+ (*decBuffer)->length = size;
+ reply.read((void *)(*decBuffer)->data, size);
+ }
return status;
}
@@ -1438,9 +1440,11 @@ status_t BnDrmManagerService::onTransact(
reply->writeInt32(status);
- const int size = decBuffer->length;
- reply->writeInt32(size);
- reply->write(decBuffer->data, size);
+ if (status == NO_ERROR) {
+ const int size = decBuffer->length;
+ reply->writeInt32(size);
+ reply->write(decBuffer->data, size);
+ }
clearDecryptHandle(&handle);
delete encBuffer; encBuffer = NULL;