Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed555d70 authored by Jeff Tinker's avatar Jeff Tinker
Browse files

Part of fix for libmedia OOB write anywhere 

Clarify that decrypt destination is not a pointer for
secure case.

b/23223325

Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
parent 39ff8149

media/libmedia/ICrypto.cpp

+3 −3
Original line number Diff line number Diff line
@@ -293,9 +293,9 @@ status_t BnCrypto::onTransact( 
                    subSamples,

                    sizeof(CryptoPlugin::SubSample) * numSubSamples);



            void *dstPtr;

            void *secureBufferId, *dstPtr;

            if (secure) {

                dstPtr = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));

                secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));

            } else {

                dstPtr = malloc(totalSize);

            }
@@ -313,7 +313,7 @@ status_t BnCrypto::onTransact( 
                    mode,

                    sharedBuffer, offset,

                    subSamples, numSubSamples,

                    dstPtr,

                    secure ? secureBufferId : dstPtr,

                    &errorDetailMsg);

            }