Part of fix for libmedia OOB write anywhere
Clarify that decrypt destination is not a pointer for
secure case.
b/23223325
Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 2f440fe..947294f 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -293,9 +293,9 @@
subSamples,
sizeof(CryptoPlugin::SubSample) * numSubSamples);
- void *dstPtr;
+ void *secureBufferId, *dstPtr;
if (secure) {
- dstPtr = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
+ secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
} else {
dstPtr = malloc(totalSize);
}
@@ -313,7 +313,7 @@
mode,
sharedBuffer, offset,
subSamples, numSubSamples,
- dstPtr,
+ secure ? secureBufferId : dstPtr,
&errorDetailMsg);
}