diff options
| author | Jeff Tinker <jtinker@google.com> | 2015-08-17 17:57:47 -0700 |
|---|---|---|
| committer | Jeff Tinker <jtinker@google.com> | 2015-08-20 20:16:22 +0000 |
| commit | aa4da6fa7ca2454f0713de0a5a583b5b8160166b (patch) | |
| tree | 849d18a0d5ad54470904bfbfe7e24004ede61cb3 /media/libmedia | |
| parent | d4f0d88e701f5323621bd352cf4cbcd14bc349c4 (diff) | |
| download | frameworks_av-aa4da6fa7ca2454f0713de0a5a583b5b8160166b.zip frameworks_av-aa4da6fa7ca2454f0713de0a5a583b5b8160166b.tar.gz frameworks_av-aa4da6fa7ca2454f0713de0a5a583b5b8160166b.tar.bz2 | |
DO NOT MERGE Part of fix for libmedia OOB write anywhere
Clarify that decrypt destination is not a pointer for
secure case.
b/23223325
Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
(cherry picked from commit ed555d70d80964f40563d89a4e6d6a80f83f4b89)
Diffstat (limited to 'media/libmedia')
| -rw-r--r-- | media/libmedia/ICrypto.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp index 0d5f990..7bd120e 100644 --- a/media/libmedia/ICrypto.cpp +++ b/media/libmedia/ICrypto.cpp @@ -247,9 +247,9 @@ status_t BnCrypto::onTransact( subSamples, sizeof(CryptoPlugin::SubSample) * numSubSamples); - void *dstPtr; + void *secureBufferId, *dstPtr; if (secure) { - dstPtr = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64())); + secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64())); } else { dstPtr = malloc(totalSize); } @@ -262,7 +262,7 @@ status_t BnCrypto::onTransact( mode, srcData, subSamples, numSubSamples, - dstPtr, + secure ? secureBufferId : dstPtr, &errorDetailMsg); reply->writeInt32(result); |