Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28acbc82 authored by Jeff Tinker's avatar Jeff Tinker Committed by Michael Bestas
Browse files

DO NOT MERGE Fix vulnerability in mediaserver 

ICrypto.cpp: ASLR bypass using DECRYPT IPC

bug: 24074485
Change-Id: I40dd0e92083c7093030393b16dbab59323306a4e
(cherry picked from commit 636539eb)
parent 9b2a7f24

media/libmedia/ICrypto.cpp

+2 −0
Original line number Diff line number Diff line
@@ -236,6 +236,7 @@ status_t BnCrypto::onTransact( 


            size_t totalSize = data.readInt32();

            void *srcData = malloc(totalSize);

            memset(srcData, 0, totalSize);

            data.read(srcData, totalSize);



            int32_t numSubSamples = data.readInt32();
@@ -252,6 +253,7 @@ status_t BnCrypto::onTransact( 
                secureBufferId = (void *)data.readIntPtr();

            } else {

                dstPtr = malloc(totalSize);

                memset(dstPtr, 0, totalSize);

            }



            AString errorDetailMsg;