commit 501a65a645b5a666a2337bbc69ba26d6848a5c55
author Jeff Tinker <jtinker@google.com> Mon Aug 17 17:57:47 2015 -0700
committer The Android Automerger <android-build@android.com> Wed Sep 02 18:26:31 2015 -0700
tree 3eb3300c9b94cf5cff900862135a9bb9bc887d4f
parent 35169cfda4a52fc288b5ae8b4c6823d036d1af3d

DO NOT MERGE Part of fix for libmedia OOB write anywhere

Clarify that decrypt destination is not a pointer for
secure case.

b/23223325

Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
(cherry picked from commit ed555d70d80964f40563d89a4e6d6a80f83f4b89)

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index c26c5bf..f7d8bc6 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -257,9 +257,9 @@
                     subSamples,
                     sizeof(CryptoPlugin::SubSample) * numSubSamples);
 
-            void *dstPtr;
+            void *secureBufferId, *dstPtr;
             if (secure) {
-                dstPtr = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
+                secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
             } else {
                 dstPtr = malloc(totalSize);
             }
@@ -272,7 +272,7 @@
                     mode,
                     srcData,
                     subSamples, numSubSamples,
-                    dstPtr,
+                    secure ? secureBufferId : dstPtr,
                     &errorDetailMsg);
 
             reply->writeInt32(result);