commit 4aabc95234e76838ab5014436cd4882cc5334113
author Chong Zhang <chz@google.com> Wed Mar 21 15:52:21 2018 -0700
committer Chong Zhang <chz@google.com> Fri Mar 23 18:50:38 2018 -0700
tree f81ec2fb179c69e70d2d5095e9c94e25c6f3afa4
parent 3bf9a53ff39ebb2ea4a666957c32499c40f9a06f

cas: fix UAF in descrambler

Change the plugin holder in both CasImpl and DescramblerImpl
to shared_ptr, and use atomic store/load for read/write.

bug: 73172817
Test:CTS MediaCasTest, VTS VtsHalCasV1_0Target, poc in bug
Change-Id: I3f1472d3b9d8d3dc74168c07325c5c319a96807d

cas/1.0/default/CasImpl.h

diff --git a/cas/1.0/default/CasImpl.h b/cas/1.0/default/CasImpl.h
index 841d64e..d792838 100644
--- a/cas/1.0/default/CasImpl.h
+++ b/cas/1.0/default/CasImpl.h
@@ -88,7 +88,7 @@
 private:
     struct PluginHolder;
     sp<SharedLibrary> mLibrary;
-    sp<PluginHolder> mPluginHolder;
+    std::shared_ptr<CasPlugin> mPluginHolder;
     sp<ICasListener> mListener;
 
     DISALLOW_EVIL_CONSTRUCTORS(CasImpl);