Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d72eb06 authored by mspector@google.com's avatar mspector@google.com
Browse files

IOMX.cpp uninitialized pointer in BnOMX::onTransact 

This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning

Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
parent 1e258cd0

media/libmedia/IOMX.cpp

+5 −3
Original line number Diff line number Diff line
@@ -381,7 +381,7 @@ public: 
        remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);



        status_t err = reply.readInt32();

        if (sidebandHandle) {

        if (err == OK && sidebandHandle) {

            *sidebandHandle = (native_handle_t *)reply.readNativeHandle();

        }

        return err;
@@ -833,11 +833,13 @@ status_t BnOMX::onTransact( 
            OMX_BOOL tunneled = (OMX_BOOL)data.readInt32();

            OMX_U32 audio_hw_sync = data.readInt32();



            native_handle_t *sideband_handle;

            native_handle_t *sideband_handle = NULL;

            status_t err = configureVideoTunnelMode(

                    node, port_index, tunneled, audio_hw_sync, &sideband_handle);

            reply->writeInt32(err);

            if(err == OK){

                reply->writeNativeHandle(sideband_handle);

            }



            return NO_ERROR;

        }