commit 46dc302886ba4181e9d1aa62b1d65fc72571d9f5
author Pawin Vongmasa <pawin@google.com> Wed Jul 26 16:42:54 2017 -0700
committer Nikoli Cartagena <dargeren@google.com> Mon Nov 13 17:15:05 2017 -0800
tree 60ba5ea477a585827e072410a5677ea363ced61d
parent c237f31f60c066611ad01252919d2637c5e58b1f

Fix the UAF bug caused by a dead stack variable

The original code attempts to copy data from a location pointed to by a
local variable that has gone out of scope. This CL moves the copy
operation into the scope.

Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 63773604
Change-Id: I980630b6ac30875c2df65664668d4d6b7414f3a7
(cherry picked from commit eb87179aa130ef1f243f229f1cccc7f55d04ca62)

media/libstagefright/MPEG4Writer.cpp

diff --git a/media/libstagefright/MPEG4Writer.cpp b/media/libstagefright/MPEG4Writer.cpp
index 5e96c2b..6ca2abb 100644
--- a/media/libstagefright/MPEG4Writer.cpp
+++ b/media/libstagefright/MPEG4Writer.cpp
@@ -1674,10 +1674,12 @@
             || !strcasecmp(mime, MEDIA_MIMETYPE_AUDIO_AAC)) {
         if (mMeta->findData(kKeyESDS, &type, &data, &size)) {
             ESDS esds(data, size);
-            if (esds.getCodecSpecificInfo(&data, &size) != OK) {
-                data = NULL;
-                size = 0;
+            if (esds.getCodecSpecificInfo(&data, &size) == OK &&
+                    data != NULL &&
+                    copyCodecSpecificData((uint8_t*)data, size) == OK) {
+                mGotAllCodecSpecificData = true;
             }
+            return;
         }
     }
     if (data != NULL && copyCodecSpecificData((uint8_t *)data, size) == OK) {