[RESTRICT AUTOMERGE] Fix possible uaf of play policy state am: e07417a9b7 (a4af83a4) · Commits · e / os / android_frameworks_av

drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp

+1 −0

Original line number	Diff line number	Diff line
		@@ -207,6 +207,7 @@ status_t DrmPlugin::queryKeyStatus(
		}

		infoMap.clear();
		android::Mutex::Autolock lock(mPlayPolicyLock);
		for (size_t i = 0; i < mPlayPolicy.size(); ++i) {
		infoMap.add(mPlayPolicy.keyAt(i), mPlayPolicy.valueAt(i));
		}

+1 −1

Original line number	Diff line number	Diff line
		@@ -262,7 +262,7 @@ private:
		void initProperties();
		void setPlayPolicy();

		android::Mutex mPlayPolicyLock;
		mutable android::Mutex mPlayPolicyLock;
		android::KeyedVector<String8, String8> mPlayPolicy;
		android::KeyedVector<String8, String8> mStringProperties;
		android::KeyedVector<String8, Vector<uint8_t>> mByteArrayProperties;

+2 −1

Original line number	Diff line number	Diff line
		@@ -576,7 +576,6 @@ Return<Status> DrmPlugin::setPropertyByteArray(
		Return<void> DrmPlugin::queryKeyStatus(
		const hidl_vec<uint8_t>& sessionId,
		queryKeyStatus_cb _hidl_cb) {

		if (sessionId.size() == 0) {
		// Returns empty key status KeyValue pair
		_hidl_cb(Status::BAD_VALUE, hidl_vec<KeyValue>());
		@@ -586,12 +585,14 @@ Return<void> DrmPlugin::queryKeyStatus(
		std::vector<KeyValue> infoMapVec;
		infoMapVec.clear();

		mPlayPolicyLock.lock();
		KeyValue keyValuePair;
		for (size_t i = 0; i < mPlayPolicy.size(); ++i) {
		keyValuePair.key = mPlayPolicy[i].key;
		keyValuePair.value = mPlayPolicy[i].value;
		infoMapVec.push_back(keyValuePair);
		}
		mPlayPolicyLock.unlock();
		_hidl_cb(Status::OK, toHidlVec(infoMapVec));
		return Void();
		}