commit 5f126c0d09b55817d1f94b3845a3c220981a622d
author Abhishek Arya <aarya@google.com> Fri Aug 21 15:34:50 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Fri Aug 21 15:34:50 2015 +0000
tree 78aea84412b7abd2190379a762a486d7f9bbf5b4
parent 386c576aae9a75b31abd3122cc62520087d3a339
parent e93a33a8f2706d3918634d17c33491f69060a62c

am e93a33a8: am 8cc71bc8: Merge "DO NOT MERGE Part of fix for libmedia OOB write anywhere" into lmp-dev

* commit 'e93a33a8f2706d3918634d17c33491f69060a62c':
  DO NOT MERGE Part of fix for libmedia OOB write anywhere

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index c26c5bf..f7d8bc6 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -257,9 +257,9 @@
                     subSamples,
                     sizeof(CryptoPlugin::SubSample) * numSubSamples);
 
-            void *dstPtr;
+            void *secureBufferId, *dstPtr;
             if (secure) {
-                dstPtr = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
+                secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
             } else {
                 dstPtr = malloc(totalSize);
             }
@@ -272,7 +272,7 @@
                     mode,
                     srcData,
                     subSamples, numSubSamples,
-                    dstPtr,
+                    secure ? secureBufferId : dstPtr,
                     &errorDetailMsg);
 
             reply->writeInt32(result);