commit aed557c01e7129599d23b7f0918c049c16de910a
author mspector@google.com <mspector@google.com> Mon Feb 08 10:56:13 2016 -0800
committer The Android Automerger <android-build@google.com> Tue Mar 01 13:17:55 2016 -0800
tree f93aea5dded4863e98204cd9341ed678b67963c6
parent b22bf8da7b5f0d9bc2b60da58ab882bac079fcf8

IOMX.cpp uninitialized pointer in BnOMX::onTransact

This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning

Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
(cherry picked from commit 9d72eb068206ecdd212679c9649e93309f1f76bc)

media/libmedia/IOMX.cpp

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index e362f80..12277e4 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -446,7 +446,7 @@
         remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);
 
         status_t err = reply.readInt32();
-        if (sidebandHandle) {
+        if (err == OK && sidebandHandle) {
             *sidebandHandle = (native_handle_t *)reply.readNativeHandle();
         }
         return err;
@@ -953,11 +953,13 @@
             OMX_BOOL tunneled = (OMX_BOOL)data.readInt32();
             OMX_U32 audio_hw_sync = data.readInt32();
 
-            native_handle_t *sideband_handle;
+            native_handle_t *sideband_handle = NULL;
             status_t err = configureVideoTunnelMode(
                     node, port_index, tunneled, audio_hw_sync, &sideband_handle);
             reply->writeInt32(err);
-            reply->writeNativeHandle(sideband_handle);
+            if(err == OK){
+                reply->writeNativeHandle(sideband_handle);
+            }
 
             return NO_ERROR;
         }