Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fad26c14 authored by Santhosh Behara's avatar Santhosh Behara Committed by Pawin Vongmasa
Browse files

libmedia: Fix null pointer crash in secure buffer allocation. 

Add null pointer check for native_handle as it is null if
secure memory allocation fails.

Author: Vasantha Balla<vballa@codeaurora.org>

Test: fix the bug
Bug: 71053053
Change-Id: I204ca69b9808448788c83a1ae5a642618eca8973
(cherry picked from commit 617b0827bc7daf66272455034c1dddd10b846663)
parent bf4637b5

media/libmedia/omx/1.0/WOmxNode.cpp

+2 −1
Original line number Diff line number Diff line
@@ -151,7 +151,8 @@ status_t LWOmxNode::allocateSecureBuffer( 
                    hidl_handle const& outNativeHandle) {

                fnStatus = toStatusT(status);

                *buffer = outBuffer;

                *native_handle = NativeHandle::create(

                *native_handle = outNativeHandle.getNativeHandle() == nullptr ?

                        nullptr : NativeHandle::create(

                        native_handle_clone(outNativeHandle), true);

            }));

    return transStatus == NO_ERROR ? fnStatus : transStatus;

media/libstagefright/omx/1.0/WOmxNode.cpp

+2 −1
Original line number Diff line number Diff line
@@ -154,7 +154,8 @@ status_t LWOmxNode::allocateSecureBuffer( 
                    hidl_handle const& outNativeHandle) {

                fnStatus = toStatusT(status);

                *buffer = outBuffer;

                *native_handle = NativeHandle::create(

                *native_handle = outNativeHandle.getNativeHandle() == nullptr ?

                        nullptr : NativeHandle::create(

                        native_handle_clone(outNativeHandle), true);

            }));

    return transStatus == NO_ERROR ? fnStatus : transStatus;