Merge tag 'android-8.1.0_r76' of https://android.googlesource.com/platform/frameworks/av into staging/lineage-15.1_merge-android-8.1.0_r76lineage-15.1

Android 8.1.0 release 76

* tag 'android-8.1.0_r76' of https://android.googlesource.com/platform/frameworks/av:
  BnCrypto: fix use-before-init in CREATE_PLUGIN
  [DO NOT MERGE] Fix uninitialized data in IHDCP decrypt

Change-Id: I913206116c2b4fc1b29757ea76c7b67eeb60d707

2 files changed, 17 insertions, 8 deletions

diff --git a/drm/libmediadrm/ICrypto.cpp b/drm/libmediadrm/ICrypto.cpp
index ee5ea936c4..7931ed755c 100644
--- a/drm/libmediadrm/ICrypto.cpp
+++ b/drm/libmediadrm/ICrypto.cpp
@@ -264,8 +264,12 @@ status_t BnCrypto::onTransact(
         {
             CHECK_INTERFACE(ICrypto, data, reply);
 
-            uint8_t uuid[16];
-            data.read(uuid, sizeof(uuid));
+            uint8_t uuid[16] = {0};
+            if (data.read(uuid, sizeof(uuid)) != NO_ERROR) {
+                android_errorWriteLog(0x534e4554, "144767096");
+                reply->writeInt32(BAD_VALUE);
+                return OK;
+            }
 
             size_t opaqueSize = data.readInt32();
             void *opaqueData = NULL;
@@ -280,7 +284,11 @@ status_t BnCrypto::onTransact(
                 return NO_MEMORY;
             }
 
-            data.read(opaqueData, opaqueSize);
+            if (data.read(opaqueData, opaqueSize) != NO_ERROR) {
+                android_errorWriteLog(0x534e4554, "144767096");
+                reply->writeInt32(BAD_VALUE);
+                return OK;
+            }
             reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize));
 
             free(opaqueData);
diff --git a/media/libmedia/IHDCP.cpp b/media/libmedia/IHDCP.cpp
index a46017ff9d..c608175ddd 100644
--- a/media/libmedia/IHDCP.cpp
+++ b/media/libmedia/IHDCP.cpp
@@ -333,11 +333,12 @@ status_t BnHDCP::onTransact(
 
             void *outData = (uint8_t *)inData + size;
 
-            data.read(inData, size);
-
-            uint32_t streamCTR = data.readInt32();
-            uint64_t inputCTR = data.readInt64();
-            status_t err = decrypt(inData, size, streamCTR, inputCTR, outData);
+            status_t err = data.read(inData, size);
+            if (err == OK) {
+                uint32_t streamCTR = data.readInt32();
+                uint64_t inputCTR = data.readInt64();
+                err = decrypt(inData, size, streamCTR, inputCTR, outData);
+            }
 
             reply->writeInt32(err);