tree 6dbc19849752c206e135ab59349ebb1cc62bb435
parent a1a25ff30e8e9f46d4da72bac672469352c839bb
author Janis Danisevskis <jdanis@google.com> 1528158345 -0700
committer Janis Danisevskis <jdanis@google.com> 1528159498 -0700

Invalid ownership transfer in keymaster2_passthrough_context

In Keymaster2PassthroughContext::ParseKeyBlob we use GetTagValue to
retrieve the blobs of application id and application value. GetTagValue
only fills a keymaster_blob_t with pointers to memory owned by the
corresponding AuthorizationSet, however, we passed in pointers to
KeymasterBob which takes ownership leading to an invalid free.

This was independently reported and fixed by:
Yan, Shaopu <shaopu.yan@intel.com>
vink.shen@mediatek.corp-partner.google.com

Bug: 79305673
Bug: 80554869
Change-Id: I1c8e54ba5fe1d2d6b70abc9cf95432fb1c5e55f6