Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 593a4bc5 authored by Robert Shih's avatar Robert Shih
Browse files

Fix use-after-free in AMediaExtractor_getSampleCryptoInfo 

Bug: 186473060
Change-Id: I9a2cab14d3b34af8723883fbf7bff8dc6fbadb5c
Test: atest NativeMediaDrmClearkeyTest
parent 8530ee45

media/ndk/NdkMediaExtractor.cpp

+4 −2
Original line number Diff line number Diff line
@@ -388,9 +388,11 @@ AMediaCodecCryptoInfo *AMediaExtractor_getSampleCryptoInfo(AMediaExtractor *ex) 
        mode = CryptoPlugin::kMode_AES_CTR;

    }



    sp<ABuffer> clearbuf;

    sp<ABuffer> cryptedbuf;

    if (sizeof(uint32_t) != sizeof(size_t)) {

        sp<ABuffer> clearbuf   = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)cleardata);

        sp<ABuffer> cryptedbuf = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)crypteddata);

        clearbuf   = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)cleardata);

        cryptedbuf = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)crypteddata);

        cleardata   = clearbuf    == NULL ? NULL : clearbuf->data();

        crypteddata = crypteddata == NULL ? NULL : cryptedbuf->data();

        if(crypteddata == NULL || cleardata == NULL) {