diff --git a/include/media/IOMX.h b/include/media/IOMX.h
index 673c56a..15d691f 100644
--- a/include/media/IOMX.h
+++ b/include/media/IOMX.h
@@ -37,6 +37,7 @@
 class IMemory;
 class IOMXObserver;
 class IOMXRenderer;
+class NativeHandle;
 class Surface;
 
 class IOMX : public IInterface {
@@ -149,7 +150,7 @@
     // pointer is just that, a pointer into local address space.
     virtual status_t allocateSecureBuffer(
             node_id node, OMX_U32 port_index, size_t size,
-            buffer_id *buffer, void **buffer_data, native_handle_t **native_handle) = 0;
+            buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle) = 0;
 
     // Allocate an OMX buffer of size |allotedSize|. Use |params| as the backup buffer, which
     // may be larger.
diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 797a5f7..b5c4006 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -487,7 +487,7 @@
 
     virtual status_t allocateSecureBuffer(
             node_id node, OMX_U32 port_index, size_t size,
-            buffer_id *buffer, void **buffer_data, native_handle_t **native_handle) {
+            buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle) {
         Parcel data, reply;
         data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
         data.writeInt32((int32_t)node);
@@ -506,7 +506,8 @@
         *buffer = (buffer_id)reply.readInt32();
         *buffer_data = (void *)reply.readInt64();
         if (*buffer_data == NULL) {
-            *native_handle = reply.readNativeHandle();
+            *native_handle = NativeHandle::create(
+                    reply.readNativeHandle(), true /* ownsHandle */);
         } else {
             *native_handle = NULL;
         }
@@ -1104,7 +1105,7 @@
 
             buffer_id buffer;
             void *buffer_data = NULL;
-            native_handle_t *native_handle = NULL;
+            sp<NativeHandle> native_handle;
             status_t err = allocateSecureBuffer(
                     node, port_index, size, &buffer, &buffer_data, &native_handle);
             reply->writeInt32(err);
@@ -1113,7 +1114,7 @@
                 reply->writeInt32((int32_t)buffer);
                 reply->writeInt64((uintptr_t)buffer_data);
                 if (buffer_data == NULL) {
-                    reply->writeNativeHandle(native_handle);
+                    reply->writeNativeHandle(native_handle == NULL ? NULL : native_handle->handle());
                 }
             }
 
diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index 27c1a64..6ff9fdb 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -868,7 +868,7 @@
                     mem.clear();
 
                     void *ptr = NULL;
-                    native_handle_t *native_handle = NULL;
+                    sp<NativeHandle> native_handle;
                     err = mOMX->allocateSecureBuffer(
                             mNode, portIndex, bufSize, &info.mBufferID,
                             &ptr, &native_handle);
@@ -881,8 +881,11 @@
 
                     // TRICKY2: use native handle as the base of the ABuffer if received one,
                     // because Widevine source only receives these base addresses.
-                    info.mData = new ABuffer(ptr != NULL ? ptr : (void *)native_handle, bufSize);
-                    info.mNativeHandle = NativeHandle::create(native_handle, true /* ownsHandle */);
+                    const native_handle_t *native_handle_ptr =
+                        native_handle == NULL ? NULL : native_handle->handle();
+                    info.mData = new ABuffer(
+                            ptr != NULL ? ptr : (void *)native_handle_ptr, bufSize);
+                    info.mNativeHandle = native_handle;
                     info.mCodecData = info.mData;
                 } else if (mQuirks & requiresAllocateBufferBit) {
                     err = mOMX->allocateBufferWithBackup(
diff --git a/media/libstagefright/OMXClient.cpp b/media/libstagefright/OMXClient.cpp
index e19c9f6..4dde5f6 100644
--- a/media/libstagefright/OMXClient.cpp
+++ b/media/libstagefright/OMXClient.cpp
@@ -131,7 +131,7 @@
 
     virtual status_t allocateSecureBuffer(
             node_id node, OMX_U32 port_index, size_t size,
-            buffer_id *buffer, void **buffer_data, native_handle_t **native_handle);
+            buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle);
 
     virtual status_t allocateBufferWithBackup(
             node_id node, OMX_U32 port_index, const sp<IMemory> &params,
@@ -426,7 +426,7 @@
 
 status_t MuxOMX::allocateSecureBuffer(
         node_id node, OMX_U32 port_index, size_t size,
-        buffer_id *buffer, void **buffer_data, native_handle_t **native_handle) {
+        buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle) {
     return getOMX(node)->allocateSecureBuffer(
             node, port_index, size, buffer, buffer_data, native_handle);
 }
diff --git a/media/libstagefright/include/OMX.h b/media/libstagefright/include/OMX.h
index 53bf5d6..6c073f0 100644
--- a/media/libstagefright/include/OMX.h
+++ b/media/libstagefright/include/OMX.h
@@ -115,7 +115,7 @@
 
     virtual status_t allocateSecureBuffer(
             node_id node, OMX_U32 port_index, size_t size,
-            buffer_id *buffer, void **buffer_data, native_handle_t **native_handle);
+            buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle);
 
     virtual status_t allocateBufferWithBackup(
             node_id node, OMX_U32 port_index, const sp<IMemory> &params,
diff --git a/media/libstagefright/include/OMXNodeInstance.h b/media/libstagefright/include/OMXNodeInstance.h
index 736718c..e98156e 100644
--- a/media/libstagefright/include/OMXNodeInstance.h
+++ b/media/libstagefright/include/OMXNodeInstance.h
@@ -102,7 +102,7 @@
 
     status_t allocateSecureBuffer(
             OMX_U32 portIndex, size_t size, OMX::buffer_id *buffer,
-            void **buffer_data, native_handle_t **native_handle);
+            void **buffer_data, sp<NativeHandle> *native_handle);
 
     status_t allocateBufferWithBackup(
             OMX_U32 portIndex, const sp<IMemory> &params,
diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp
index 7121ac4..f7058d7 100644
--- a/media/libstagefright/omx/OMX.cpp
+++ b/media/libstagefright/omx/OMX.cpp
@@ -546,7 +546,7 @@
 
 status_t OMX::allocateSecureBuffer(
         node_id node, OMX_U32 port_index, size_t size,
-        buffer_id *buffer, void **buffer_data, native_handle_t **native_handle) {
+        buffer_id *buffer, void **buffer_data, sp<NativeHandle> *native_handle) {
     OMXNodeInstance *instance = findInstance(node);
 
     if (instance == NULL) {
diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 70c5cb1..462db95 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -36,7 +36,6 @@
 #include <media/stagefright/foundation/ADebug.h>
 #include <media/stagefright/foundation/ABuffer.h>
 #include <media/stagefright/MediaErrors.h>
-
 #include <utils/misc.h>
 #include <utils/NativeHandle.h>
 
@@ -1065,7 +1064,7 @@
 
 status_t OMXNodeInstance::allocateSecureBuffer(
         OMX_U32 portIndex, size_t size, OMX::buffer_id *buffer,
-        void **buffer_data, native_handle_t **native_handle) {
+        void **buffer_data, sp<NativeHandle> *native_handle) {
     if (buffer == NULL || buffer_data == NULL || native_handle == NULL) {
         ALOGE("b/25884056");
         return BAD_VALUE;
@@ -1095,7 +1094,8 @@
     *buffer = makeBufferID(header);
     if (mSecureBufferType[portIndex] == kSecureBufferTypeNativeHandle) {
         *buffer_data = NULL;
-        *native_handle = (native_handle_t *)header->pBuffer;
+        *native_handle = NativeHandle::create(
+                (native_handle_t *)header->pBuffer, false /* ownsHandle */);
     } else {
         *buffer_data = header->pBuffer;
         *native_handle = NULL;
@@ -1108,7 +1108,8 @@
         bufferSource->addCodecBuffer(header);
     }
     CLOG_BUFFER(allocateSecureBuffer, NEW_BUFFER_FMT(
-            *buffer, portIndex, "%zu@%p:%p", size, *buffer_data, *native_handle));
+            *buffer, portIndex, "%zu@%p:%p", size, *buffer_data,
+            *native_handle == NULL ? NULL : (*native_handle)->handle()));
 
     return OK;
 }