commit 0415ec31978d83e4e287ad82f77aaaddbb125620
author Santhosh Behara <santhoshbehara@codeaurora.org> Mon Oct 16 17:23:54 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 16 22:11:39 2018 +0000
tree 41667455cd3edc777c7c9fb7cf4fb56d9f919865
parent 6ce0a6599bb03615b194231d818dd8d629aec953

libmedia: Fix null pointer crash in secure buffer allocation.

Add null pointer check for native_handle as it is null if
secure memory allocation fails.

Author: Vasantha Balla<vballa@codeaurora.org>

Test: fix the bug
Bug: 71053053
Merged-In: I204ca69b9808448788c83a1ae5a642618eca8973
Change-Id: I204ca69b9808448788c83a1ae5a642618eca8973
(cherry picked from commit fad26c14c7e68c3fe40bda8fd5692b8dbfac1000)
(cherry picked from commit ddd508e96da76a3e2de3d8dfef16e4d0d07fbf9b)

media/libmedia/omx/1.0/WOmxNode.cpp

diff --git a/media/libmedia/omx/1.0/WOmxNode.cpp b/media/libmedia/omx/1.0/WOmxNode.cpp
index 0b40e8d..2cd8b76 100644
--- a/media/libmedia/omx/1.0/WOmxNode.cpp
+++ b/media/libmedia/omx/1.0/WOmxNode.cpp
@@ -151,7 +151,8 @@
                     hidl_handle const& outNativeHandle) {
                 fnStatus = toStatusT(status);
                 *buffer = outBuffer;
-                *native_handle = NativeHandle::create(
+                *native_handle = outNativeHandle.getNativeHandle() == nullptr ?
+                        nullptr : NativeHandle::create(
                         native_handle_clone(outNativeHandle), true);
             }));
     return transStatus == NO_ERROR ? fnStatus : transStatus;

media/libstagefright/omx/1.0/WOmxNode.cpp

diff --git a/media/libstagefright/omx/1.0/WOmxNode.cpp b/media/libstagefright/omx/1.0/WOmxNode.cpp
index 9f82283..1dc7c7b 100644
--- a/media/libstagefright/omx/1.0/WOmxNode.cpp
+++ b/media/libstagefright/omx/1.0/WOmxNode.cpp
@@ -154,7 +154,8 @@
                     hidl_handle const& outNativeHandle) {
                 fnStatus = toStatusT(status);
                 *buffer = outBuffer;
-                *native_handle = NativeHandle::create(
+                *native_handle = outNativeHandle.getNativeHandle() == nullptr ?
+                        nullptr : NativeHandle::create(
                         native_handle_clone(outNativeHandle), true);
             }));
     return transStatus == NO_ERROR ? fnStatus : transStatus;