commit 272c895e9cb3fdf53f73b0ec5b1bfa75c910e879
author Chong Zhang <chz@google.com> Mon Oct 22 17:34:45 2018 -0700
committer Chong Zhang <chz@google.com> Tue Oct 23 17:02:39 2018 +0000
tree 4c6691366071a0dfaa2a110dbc929add7b189808
parent f45f32cc8cb72a13ef47373233088ab7523e7e67

Fix string use-after-free in mediaswcodec

Bug:118190129
Change-Id: I7228e8eeb7d5e616d0ce19d9603667dc7b1a9ba7

services/mediacodec/MediaCodecUpdateService.cpp

diff --git a/services/mediacodec/MediaCodecUpdateService.cpp b/services/mediacodec/MediaCodecUpdateService.cpp
index a2bb469..aee890d 100644
--- a/services/mediacodec/MediaCodecUpdateService.cpp
+++ b/services/mediacodec/MediaCodecUpdateService.cpp
@@ -71,10 +71,10 @@
         String8 libPathInApk = String8("lib/") + String8(abis[0].c_str());
         String8 defaultLibPath = String8(apkPath.c_str()) + "!/" + libPathInApk;
         String8 libPath = defaultLibPath + "/libmedia_codecserviceregistrant.so";
+        String8 zipEntryPath = libPathInApk + "/libmedia_codecserviceregistrant.so";
 
         ZipEntry entry;
-        ZipString name(libPathInApk + "/libmedia_codecserviceregistrant.so");
-        ret = FindEntry(zipHandle, name, &entry);
+        ret = FindEntry(zipHandle, ZipString(zipEntryPath), &entry);
 
         if (ret == 0) {
             android_namespace_t *codecNs = android_create_namespace("codecs",