commit 4aabc95234e76838ab5014436cd4882cc5334113
author Chong Zhang <chz@google.com> Wed Mar 21 15:52:21 2018 -0700
committer Chong Zhang <chz@google.com> Fri Mar 23 18:50:38 2018 -0700
tree f81ec2fb179c69e70d2d5095e9c94e25c6f3afa4
parent 3bf9a53ff39ebb2ea4a666957c32499c40f9a06f

cas: fix UAF in descrambler

Change the plugin holder in both CasImpl and DescramblerImpl
to shared_ptr, and use atomic store/load for read/write.

bug: 73172817
Test:CTS MediaCasTest, VTS VtsHalCasV1_0Target, poc in bug
Change-Id: I3f1472d3b9d8d3dc74168c07325c5c319a96807d

cas/1.0/default/DescramblerImpl.h

diff --git a/cas/1.0/default/DescramblerImpl.h b/cas/1.0/default/DescramblerImpl.h
index d3b146e..305f115 100644
--- a/cas/1.0/default/DescramblerImpl.h
+++ b/cas/1.0/default/DescramblerImpl.h
@@ -55,7 +55,7 @@
 
 private:
     sp<SharedLibrary> mLibrary;
-    DescramblerPlugin *mPlugin;
+    std::shared_ptr<DescramblerPlugin> mPluginHolder;
 
     DISALLOW_EVIL_CONSTRUCTORS(DescramblerImpl);
 };