commit e7f49abff71b5d2863a3774b9ebd0e9c704f9f76
author Jeff Tinker <jtinker@google.com> Wed Sep 16 13:21:51 2015 -0700
committer The Android Automerger <android-build@google.com> Tue Oct 27 15:22:08 2015 -0700
tree 2b678b7c8e862e3f86c07aac46045ce5123fb125
parent 3c9fb1d69c354320ad6be50a98e573c0935cce26

DO NOT MERGE Fix vulnerability in mediaserver

ICrypto.cpp: ASLR bypass using DECRYPT IPC

bug: 24074485
Change-Id: I61cd77f0894140547f666a80526ebfe1ec3d2db6

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 9703b0d..a398ff7 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -297,7 +297,7 @@
             if (secure) {
                 secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
             } else {
-                dstPtr = malloc(totalSize);
+                dstPtr = calloc(1, totalSize);
             }
 
             AString errorDetailMsg;