diff options
| author | Jeff Tinker <jtinker@google.com> | 2015-09-14 13:55:23 -0700 |
|---|---|---|
| committer | Michael Bestas <mikeioannina@gmail.com> | 2015-11-10 00:00:16 +0200 |
| commit | 92b4787e3fc8bd93d95b20c640c706d09ad1e5d9 (patch) | |
| tree | b19524c34ee27de4140385849e2e1277b9bd6677 /drm/common | |
| parent | 5ce45a25edf8b9a7a0cb11bae7dba7f3f8371e29 (diff) | |
| download | frameworks_av-92b4787e3fc8bd93d95b20c640c706d09ad1e5d9.tar.gz frameworks_av-92b4787e3fc8bd93d95b20c640c706d09ad1e5d9.tar.bz2 frameworks_av-92b4787e3fc8bd93d95b20c640c706d09ad1e5d9.zip | |
Fix heap data leak vulnerability
bug: 23600291
Change-Id: I7979e9e25ada01c13775be8580d433a8b4ce4ffe
(cherry picked from commit 09ed70fab1f1424971ccc105dcdf5be5ce2e2643)
Diffstat (limited to 'drm/common')
| -rw-r--r-- | drm/common/IDrmManagerService.cpp | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/drm/common/IDrmManagerService.cpp b/drm/common/IDrmManagerService.cpp index db41e0bd70..c235201796 100644 --- a/drm/common/IDrmManagerService.cpp +++ b/drm/common/IDrmManagerService.cpp @@ -741,9 +741,11 @@ status_t BpDrmManagerService::decrypt( const status_t status = reply.readInt32(); ALOGV("Return value of decrypt() is %d", status); - const int size = reply.readInt32(); - (*decBuffer)->length = size; - reply.read((void *)(*decBuffer)->data, size); + if (status == NO_ERROR) { + const int size = reply.readInt32(); + (*decBuffer)->length = size; + reply.read((void *)(*decBuffer)->data, size); + } return status; } @@ -1438,9 +1440,11 @@ status_t BnDrmManagerService::onTransact( reply->writeInt32(status); - const int size = decBuffer->length; - reply->writeInt32(size); - reply->write(decBuffer->data, size); + if (status == NO_ERROR) { + const int size = decBuffer->length; + reply->writeInt32(size); + reply->write(decBuffer->data, size); + } clearDecryptHandle(&handle); delete encBuffer; encBuffer = NULL; |