Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edb048c1 authored by Edwin Wong's avatar Edwin Wong Committed by Android (Google) Code Review
Browse files

Merge "Fix possible uaf of play policy state" into sc-dev

parents 3f819d4a 2c075c71

drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp

+1 −0
Original line number Original line Diff line number Diff line
@@ -207,6 +207,7 @@ status_t DrmPlugin::queryKeyStatus( 
    }

    }





    infoMap.clear();

    infoMap.clear();

    android::Mutex::Autolock lock(mPlayPolicyLock);

    for (size_t i = 0; i < mPlayPolicy.size(); ++i) {

    for (size_t i = 0; i < mPlayPolicy.size(); ++i) {

        infoMap.add(mPlayPolicy.keyAt(i), mPlayPolicy.valueAt(i));

        infoMap.add(mPlayPolicy.keyAt(i), mPlayPolicy.valueAt(i));

    }

    }

drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -262,7 +262,7 @@ private: 
    void initProperties();

    void initProperties();

    void setPlayPolicy();

    void setPlayPolicy();





    android::Mutex mPlayPolicyLock;

    mutable android::Mutex mPlayPolicyLock;

    android::KeyedVector<String8, String8> mPlayPolicy;

    android::KeyedVector<String8, String8> mPlayPolicy;

    android::KeyedVector<String8, String8> mStringProperties;

    android::KeyedVector<String8, String8> mStringProperties;

    android::KeyedVector<String8, Vector<uint8_t>> mByteArrayProperties;

    android::KeyedVector<String8, Vector<uint8_t>> mByteArrayProperties;

drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp

+2 −1
Original line number Original line Diff line number Diff line
@@ -581,7 +581,6 @@ Return<Status> DrmPlugin::setPropertyByteArray( 
Return<void> DrmPlugin::queryKeyStatus(

Return<void> DrmPlugin::queryKeyStatus(

        const hidl_vec<uint8_t>& sessionId,

        const hidl_vec<uint8_t>& sessionId,

        queryKeyStatus_cb _hidl_cb) {

        queryKeyStatus_cb _hidl_cb) {



    if (sessionId.size() == 0) {

    if (sessionId.size() == 0) {

        // Returns empty key status KeyValue pair

        // Returns empty key status KeyValue pair

        _hidl_cb(Status::BAD_VALUE, hidl_vec<KeyValue>());

        _hidl_cb(Status::BAD_VALUE, hidl_vec<KeyValue>());
@@ -591,12 +590,14 @@ Return<void> DrmPlugin::queryKeyStatus( 
    std::vector<KeyValue> infoMapVec;

    std::vector<KeyValue> infoMapVec;

    infoMapVec.clear();

    infoMapVec.clear();





    mPlayPolicyLock.lock();

    KeyValue keyValuePair;

    KeyValue keyValuePair;

    for (size_t i = 0; i < mPlayPolicy.size(); ++i) {

    for (size_t i = 0; i < mPlayPolicy.size(); ++i) {

        keyValuePair.key = mPlayPolicy[i].key;

        keyValuePair.key = mPlayPolicy[i].key;

        keyValuePair.value = mPlayPolicy[i].value;

        keyValuePair.value = mPlayPolicy[i].value;

        infoMapVec.push_back(keyValuePair);

        infoMapVec.push_back(keyValuePair);

    }

    }

    mPlayPolicyLock.unlock();

    _hidl_cb(Status::OK, toHidlVec(infoMapVec));

    _hidl_cb(Status::OK, toHidlVec(infoMapVec));

    return Void();

    return Void();

}

}