Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into sc-dev (3f819d4a) · Commits · e / os / android_frameworks_av

drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp

+6 −1

Original line number	Diff line number	Diff line
		@@ -37,6 +37,8 @@ Return<void> CryptoPlugin::setSharedBufferBase(
		sp<IMemory> hidlMemory = mapMemory(base);
		ALOGE_IF(hidlMemory == nullptr, "mapMemory returns nullptr");

		std::lock_guard<std::mutex> shared_buffer_lock(mSharedBufferLock);

		// allow mapMemory to return nullptr
		mSharedBufferMap[bufferId] = hidlMemory;
		return Void();
		@@ -94,6 +96,7 @@ Return<void> CryptoPlugin::decrypt_1_2(
		return Void();
		}

		std::unique_lock<std::mutex> shared_buffer_lock(mSharedBufferLock);
		if (mSharedBufferMap.find(source.bufferId) == mSharedBufferMap.end()) {
		_hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0,
		"source decrypt buffer base not set");
		@@ -148,6 +151,8 @@ Return<void> CryptoPlugin::decrypt_1_2(
		}
		destPtr = static_cast<void*>(base + destination.nonsecureMemory.offset);

		// release mSharedBufferLock
		shared_buffer_lock.unlock();

		// Calculate the output buffer size and determine if any subsamples are
		// encrypted.

+5 −2

Original line number	Diff line number	Diff line
		@@ -20,6 +20,8 @@
		#include <android/hardware/drm/1.2/ICryptoPlugin.h>
		#include <android/hidl/memory/1.0/IMemory.h>

		#include <mutex>

		#include "ClearKeyTypes.h"
		#include "Session.h"
		#include "Utils.h"
		@@ -93,7 +95,7 @@ struct CryptoPlugin : public drm::V1_2::ICryptoPlugin {
		const SharedBuffer& source,
		uint64_t offset,
		const DestinationBuffer& destination,
		decrypt_1_2_cb _hidl_cb);
		decrypt_1_2_cb _hidl_cb) NO_THREAD_SAFETY_ANALYSIS; // use unique_lock

		Return<void> setSharedBufferBase(const hidl_memory& base,
		uint32_t bufferId);
		@@ -105,7 +107,8 @@ struct CryptoPlugin : public drm::V1_2::ICryptoPlugin {
		private:
		CLEARKEY_DISALLOW_COPY_AND_ASSIGN(CryptoPlugin);

		std::map<uint32_t, sp<IMemory> > mSharedBufferMap;
		std::mutex mSharedBufferLock;
		std::map<uint32_t, sp<IMemory>> mSharedBufferMap GUARDED_BY(mSharedBufferLock);
		sp<Session> mSession;
		Status mInitStatus;
		};