Skip to content

Commit c0bccf3

Browse files
jefftinkerandi34
authored andcommitted
DO NOT MERGE Part of fix for libmedia OOB write anywhere
Clarify that decrypt destination is not a pointer for secure case. b/23223325 Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac (cherry picked from commit ed555d7)
1 parent 4302151 commit c0bccf3

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

media/libmedia/ICrypto.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,9 @@ status_t BnCrypto::onTransact(
247247
subSamples,
248248
sizeof(CryptoPlugin::SubSample) * numSubSamples);
249249

250-
void *dstPtr;
250+
void *secureBufferId, dstPtr;
251251
if (secure) {
252-
dstPtr = (void *)data.readIntPtr();
252+
secureBufferId = (void *)data.readIntPtr();
253253
} else {
254254
dstPtr = malloc(totalSize);
255255
}
@@ -262,7 +262,7 @@ status_t BnCrypto::onTransact(
262262
mode,
263263
srcData,
264264
subSamples, numSubSamples,
265-
dstPtr,
265+
secure ? secureBufferId : dstPtr,
266266
&errorDetailMsg);
267267

268268
reply->writeInt32(result);

0 commit comments

Comments
 (0)