commit 79b73470e265c2c1cf9eafc935fadaf5eaa7c716
author mspector@google.com <mspector@google.com> Mon Feb 08 10:56:13 2016 -0800
committer The Android Automerger <android-build@google.com> Fri Feb 26 15:07:03 2016 -0800
tree 115f8086789b041e6464668b401d4853964c265a
parent 38f1da3889188fb3beeaf7fdfeb92b4444c9fb4b

IOMX.cpp uninitialized pointer in BnOMX::onTransact

This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning

Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500

media/libmedia/IOMX.cpp

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 5423c2a..8f55eb9 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -446,7 +446,7 @@
         remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);
 
         status_t err = reply.readInt32();
-        if (sidebandHandle) {
+        if (err == OK && sidebandHandle) {
             *sidebandHandle = (native_handle_t *)reply.readNativeHandle();
         }
         return err;
@@ -948,11 +948,13 @@
             OMX_BOOL tunneled = (OMX_BOOL)data.readInt32();
             OMX_U32 audio_hw_sync = data.readInt32();
 
-            native_handle_t *sideband_handle;
+            native_handle_t *sideband_handle = NULL;
             status_t err = configureVideoTunnelMode(
                     node, port_index, tunneled, audio_hw_sync, &sideband_handle);
             reply->writeInt32(err);
-            reply->writeNativeHandle(sideband_handle);
+            if(err == OK){
+                reply->writeNativeHandle(sideband_handle);
+            }
 
             return NO_ERROR;
         }