diff options
| author | mspector@google.com <mspector@google.com> | 2016-02-08 10:56:13 -0800 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-02-26 16:55:59 -0800 |
| commit | 3ba0bbe12904d0dfa2245fa3abf2b92034b15db3 (patch) | |
| tree | 115f8086789b041e6464668b401d4853964c265a /media/libmedia | |
| parent | 38f1da3889188fb3beeaf7fdfeb92b4444c9fb4b (diff) | |
| download | frameworks_av-3ba0bbe12904d0dfa2245fa3abf2b92034b15db3.zip frameworks_av-3ba0bbe12904d0dfa2245fa3abf2b92034b15db3.tar.gz frameworks_av-3ba0bbe12904d0dfa2245fa3abf2b92034b15db3.tar.bz2 | |
IOMX.cpp uninitialized pointer in BnOMX::onTransact
This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning
Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
Diffstat (limited to 'media/libmedia')
| -rw-r--r-- | media/libmedia/IOMX.cpp | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp index 5423c2a..8f55eb9 100644 --- a/media/libmedia/IOMX.cpp +++ b/media/libmedia/IOMX.cpp @@ -446,7 +446,7 @@ public: remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply); status_t err = reply.readInt32(); - if (sidebandHandle) { + if (err == OK && sidebandHandle) { *sidebandHandle = (native_handle_t *)reply.readNativeHandle(); } return err; @@ -948,11 +948,13 @@ status_t BnOMX::onTransact( OMX_BOOL tunneled = (OMX_BOOL)data.readInt32(); OMX_U32 audio_hw_sync = data.readInt32(); - native_handle_t *sideband_handle; + native_handle_t *sideband_handle = NULL; status_t err = configureVideoTunnelMode( node, port_index, tunneled, audio_hw_sync, &sideband_handle); reply->writeInt32(err); - reply->writeNativeHandle(sideband_handle); + if(err == OK){ + reply->writeNativeHandle(sideband_handle); + } return NO_ERROR; } |