commit 593a4bc5e536179c582fa7c05b9f49e0bc149a9b
author Robert Shih <robertshih@google.com> Wed Apr 20 00:58:59 2022 +0000
committer Robert Shih <robertshih@google.com> Wed Apr 20 00:59:01 2022 +0000
tree d787db2f90d2a643dafda4ac91fdbc39cdef56a0
parent 8530ee45e6728fe9e9e91eb57acf0504f5f0ee71

Fix use-after-free in AMediaExtractor_getSampleCryptoInfo

Bug: 186473060
Change-Id: I9a2cab14d3b34af8723883fbf7bff8dc6fbadb5c
Test: atest NativeMediaDrmClearkeyTest

media/ndk/NdkMediaExtractor.cpp

diff --git a/media/ndk/NdkMediaExtractor.cpp b/media/ndk/NdkMediaExtractor.cpp
index 07fc5de..6d3c348 100644
--- a/media/ndk/NdkMediaExtractor.cpp
+++ b/media/ndk/NdkMediaExtractor.cpp
@@ -388,9 +388,11 @@
         mode = CryptoPlugin::kMode_AES_CTR;
     }
 
+    sp<ABuffer> clearbuf;
+    sp<ABuffer> cryptedbuf;
     if (sizeof(uint32_t) != sizeof(size_t)) {
-        sp<ABuffer> clearbuf   = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)cleardata);
-        sp<ABuffer> cryptedbuf = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)crypteddata);
+        clearbuf   = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)cleardata);
+        cryptedbuf = U32ArrayToSizeBuf(numSubSamples, (uint32_t *)crypteddata);
         cleardata   = clearbuf    == NULL ? NULL : clearbuf->data();
         crypteddata = crypteddata == NULL ? NULL : cryptedbuf->data();
         if(crypteddata == NULL || cleardata == NULL) {