commit 1171e7c047bf79e7c93342bb6a812c9edd86aa84
author Marco Nelissen <marcone@google.com> Mon Feb 22 13:05:15 2016 -0800
committer The Android Automerger <android-build@google.com> Fri Feb 26 14:33:30 2016 -0800
tree 9144f9fb6a5f276161c83e367a4fbc0a2a8217c4
parent 25be9ac20db51044e1b09ca67906355e4f328d48

Clear allocation to avoid info leak

Bug: 26914474
Change-Id: Ie1a86e86d78058d041149fe599a4996e7f8185cf

media/libmedia/IOMX.cpp

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 5214a9d..1534144 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -618,34 +618,39 @@
 
             size_t size = data.readInt64();
 
-            void *params = malloc(size);
-            data.read(params, size);
+            status_t err = NO_MEMORY;
+            void *params = calloc(size, 1);
+            if (params) {
+                err = data.read(params, size);
+                if (err != OK) {
+                    android_errorWriteLog(0x534e4554, "26914474");
+                } else {
+                    switch (code) {
+                        case GET_PARAMETER:
+                            err = getParameter(node, index, params, size);
+                            break;
+                        case SET_PARAMETER:
+                            err = setParameter(node, index, params, size);
+                            break;
+                        case GET_CONFIG:
+                            err = getConfig(node, index, params, size);
+                            break;
+                        case SET_CONFIG:
+                            err = setConfig(node, index, params, size);
+                            break;
+                        case SET_INTERNAL_OPTION:
+                        {
+                            InternalOptionType type =
+                                (InternalOptionType)data.readInt32();
 
-            status_t err;
-            switch (code) {
-                case GET_PARAMETER:
-                    err = getParameter(node, index, params, size);
-                    break;
-                case SET_PARAMETER:
-                    err = setParameter(node, index, params, size);
-                    break;
-                case GET_CONFIG:
-                    err = getConfig(node, index, params, size);
-                    break;
-                case SET_CONFIG:
-                    err = setConfig(node, index, params, size);
-                    break;
-                case SET_INTERNAL_OPTION:
-                {
-                    InternalOptionType type =
-                        (InternalOptionType)data.readInt32();
+                            err = setInternalOption(node, index, type, params, size);
+                            break;
+                        }
 
-                    err = setInternalOption(node, index, type, params, size);
-                    break;
+                        default:
+                            TRESPASS();
+                    }
                 }
-
-                default:
-                    TRESPASS();
             }
 
             reply->writeInt32(err);