Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into rvc-dev

libwvdrmengine/mediacrypto/src_hidl/WVCryptoPlugin.cpp

@@ -110,6 +110,8 @@ Return<void> WVCryptoPlugin::setSharedBufferBase(
     const hidl_memory& base, uint32_t bufferId) {
   sp<IMemory> hidlMemory = mapMemory(base);
 
+  std::lock_guard<std::mutex> shared_buffer_lock(mSharedBufferLock);
+
   // allow mapMemory to return nullptr
   mSharedBufferMap[bufferId] = hidlMemory;
   return Void();
@@ -158,7 +160,7 @@ Return<void> WVCryptoPlugin::decrypt_1_2(
     uint64_t offset,
     const DestinationBuffer& destination,
     decrypt_1_2_cb _hidl_cb) {
-
+  std::unique_lock<std::mutex> lock(mSharedBufferLock);
   if (mSharedBufferMap.find(source.bufferId) == mSharedBufferMap.end()) {
     _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0,
              "source decrypt buffer base not set");
@@ -234,6 +236,9 @@ Return<void> WVCryptoPlugin::decrypt_1_2(
     destPtr = static_cast<void *>(handle);
   }
 
+  // release mSharedBufferLock
+  lock.unlock();
+
   // Set up the decrypt params
   CdmDecryptionParametersV16 params;
   params.key_id = cryptoKey;