From 40cb8d32a95e5ff4afa835899fa7d9d860d614cb Mon Sep 17 00:00:00 2001
From: Jeff Tinker <jtinker@google.com>
Date: Mon, 17 Aug 2015 17:57:47 -0700
Subject: DO NOT MERGE Part of fix for libmedia OOB write anywhere

Clarify that decrypt destination is not a pointer for
secure case.

b/23223325

Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
(cherry picked from commit ed555d70d80964f40563d89a4e6d6a80f83f4b89)
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
---
 media/libmedia/ICrypto.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 2defc2d..00c500a 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -131,7 +131,7 @@ struct BpCrypto : public BpInterface<ICrypto> {
         data.write(subSamples, sizeof(CryptoPlugin::SubSample) * numSubSamples);
 
         if (secure) {
-            data.writeIntPtr((intptr_t)dstPtr);
+            data.writeInt64(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(dstPtr)));
         }
 
         remote()->transact(DECRYPT, data, &reply);
@@ -247,9 +247,9 @@ status_t BnCrypto::onTransact(
                     subSamples,
                     sizeof(CryptoPlugin::SubSample) * numSubSamples);
 
-            void *dstPtr;
+            void *secureBufferId, *dstPtr;
             if (secure) {
-                dstPtr = (void *)data.readIntPtr();
+                secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
             } else {
                 dstPtr = malloc(totalSize);
             }
@@ -262,7 +262,7 @@ status_t BnCrypto::onTransact(
                     mode,
                     srcData,
                     subSamples, numSubSamples,
-                    dstPtr,
+                    secure ? secureBufferId : dstPtr,
                     &errorDetailMsg);
 
             reply->writeInt32(result);
-- 
cgit v1.1