Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a302c61 authored by Jeff Tinker's avatar Jeff Tinker Committed by Android Git Automerger
Browse files

am 963522f9: am 2151d8f9: am 78f7932d: am 7b642b08: am 0af50080: am 8ba28c84:... 

am 963522f9: am 2151d8f9: am 78f7932d: am 7b642b08: am 0af50080: am 8ba28c84: am d61dbb36: am 38281f1c: am d386c5be: Merge "Fix heap data leak vulnerability" into klp-dev

* commit '963522f9':
  Fix heap data leak vulnerability
parents 7a0c1949 963522f9

drm/common/IDrmManagerService.cpp

+10 −6
Original line number Original line Diff line number Diff line
@@ -742,9 +742,11 @@ status_t BpDrmManagerService::decrypt( 
    const status_t status = reply.readInt32();

    const status_t status = reply.readInt32();

    ALOGV("Return value of decrypt() is %d", status);

    ALOGV("Return value of decrypt() is %d", status);





    if (status == NO_ERROR) {

        const int size = reply.readInt32();

        const int size = reply.readInt32();

        (*decBuffer)->length = size;

        (*decBuffer)->length = size;

        reply.read((void *)(*decBuffer)->data, size);

        reply.read((void *)(*decBuffer)->data, size);

    }





    return status;

    return status;

}

}
@@ -1470,9 +1472,11 @@ status_t BnDrmManagerService::onTransact( 




        reply->writeInt32(status);

        reply->writeInt32(status);





        if (status == NO_ERROR) {

            const int size = decBuffer->length;

            const int size = decBuffer->length;

            reply->writeInt32(size);

            reply->writeInt32(size);

            reply->write(decBuffer->data, size);

            reply->write(decBuffer->data, size);

        }





        clearDecryptHandle(&handle);

        clearDecryptHandle(&handle);

        delete encBuffer; encBuffer = NULL;

        delete encBuffer; encBuffer = NULL;