diff options
| author | Jeff Tinker <jtinker@google.com> | 2015-08-17 17:57:47 -0700 |
|---|---|---|
| committer | Jeff Tinker <jtinker@google.com> | 2015-08-20 14:55:35 -0700 |
| commit | c2153d0dc800d0718788dccd0f2a2d29f4647c03 (patch) | |
| tree | 24cd6439538e4bf3fd0007757d86dbcb63a465a9 /media | |
| parent | 5aa887ef44238e9a727564fe9051933f8b42e399 (diff) | |
| download | frameworks_av-c2153d0dc800d0718788dccd0f2a2d29f4647c03.zip frameworks_av-c2153d0dc800d0718788dccd0f2a2d29f4647c03.tar.gz frameworks_av-c2153d0dc800d0718788dccd0f2a2d29f4647c03.tar.bz2 | |
DO NOT MERGE Part of fix for libmedia OOB write anywhere
Clarify that decrypt destination is not a pointer for
secure case.
b/23223325
Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
(cherry picked from commit ed555d70d80964f40563d89a4e6d6a80f83f4b89)
Diffstat (limited to 'media')
| -rw-r--r-- | media/libmedia/ICrypto.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp index 98b183a..55e9695 100644 --- a/media/libmedia/ICrypto.cpp +++ b/media/libmedia/ICrypto.cpp @@ -247,9 +247,9 @@ status_t BnCrypto::onTransact( subSamples, sizeof(CryptoPlugin::SubSample) * numSubSamples); - void *dstPtr; + void *secureBufferId, dstPtr; if (secure) { - dstPtr = (void *)data.readIntPtr(); + secureBufferId = (void *)data.readIntPtr(); } else { dstPtr = malloc(totalSize); } @@ -262,7 +262,7 @@ status_t BnCrypto::onTransact( mode, srcData, subSamples, numSubSamples, - dstPtr, + secure ? secureBufferId : dstPtr, &errorDetailMsg); reply->writeInt32(result); |