Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51aa2003 authored by Robert Shih's avatar Robert Shih
Browse files

BnCrypto: fix use-before-init in CREATE_PLUGIN 

Bug: 144767096
Test: poc_ICrypto_283
Change-Id: Icd57367f8d912ff0a0cf9067c732b8fce169f29d
Merged-In: Id67dc9e793ee886e4cc49370d800c7f3580df313
parent efd8f9e0

drm/libmediadrm/ICrypto.cpp

+11 −2
Original line number Original line Diff line number Diff line
@@ -264,8 +264,12 @@ status_t BnCrypto::onTransact( 
        {

        {

            CHECK_INTERFACE(ICrypto, data, reply);

            CHECK_INTERFACE(ICrypto, data, reply);





            uint8_t uuid[16];

            uint8_t uuid[16] = {0};

            data.read(uuid, sizeof(uuid));

            if (data.read(uuid, sizeof(uuid)) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "144767096");

                reply->writeInt32(BAD_VALUE);

                return OK;

            }





            size_t opaqueSize = data.readInt32();

            size_t opaqueSize = data.readInt32();

            void *opaqueData = NULL;

            void *opaqueData = NULL;
@@ -281,6 +285,11 @@ status_t BnCrypto::onTransact( 
            }

            }





            data.read(opaqueData, opaqueSize);

            data.read(opaqueData, opaqueSize);

            if (data.read(opaqueData, opaqueSize) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "144767096");

                reply->writeInt32(BAD_VALUE);

                return OK;

            }

            reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize));

            reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize));





            free(opaqueData);

            free(opaqueData);