[RESTRICT AUTOMERGE]Fix CryptoPlugin use after free vulnerability. am: 79a6ffbd

    sp<IMemory> hidlMemory = mapMemory(base);

    ALOGE_IF(hidlMemory == nullptr, "mapMemory returns nullptr");

    std::lock_guard<std::mutex> shared_buffer_lock(mSharedBufferLock);

    // allow mapMemory to return nullptr

    mSharedBufferMap[bufferId] = hidlMemory;

    return Void();

        return Void();

    }

    std::unique_lock<std::mutex> shared_buffer_lock(mSharedBufferLock);

    if (mSharedBufferMap.find(source.bufferId) == mSharedBufferMap.end()) {

      _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0,

               "source decrypt buffer base not set");

    }

    destPtr = static_cast<void*>(base + destination.nonsecureMemory.offset);

    // release mSharedBufferLock

    shared_buffer_lock.unlock();

    // Calculate the output buffer size and determine if any subsamples are

    // encrypted.

    size_t destSize = 0;

#include <android/hardware/drm/1.2/ICryptoPlugin.h>

#include <android/hidl/memory/1.0/IMemory.h>

#include <mutex>

#include "ClearKeyTypes.h"

#include "Session.h"

#include "Utils.h"

            const SharedBuffer& source,

            uint64_t offset,

            const DestinationBuffer& destination,

            decrypt_1_2_cb _hidl_cb);

            decrypt_1_2_cb _hidl_cb) NO_THREAD_SAFETY_ANALYSIS; // use unique_lock

    Return<void> setSharedBufferBase(const hidl_memory& base,

            uint32_t bufferId);

private:

    CLEARKEY_DISALLOW_COPY_AND_ASSIGN(CryptoPlugin);

    std::map<uint32_t, sp<IMemory> > mSharedBufferMap;

    std::mutex mSharedBufferLock;

    std::map<uint32_t, sp<IMemory>> mSharedBufferMap GUARDED_BY(mSharedBufferLock);

    sp<Session> mSession;

    Status mInitStatus;

};