widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,572 Commits 2 Branches 0 Tags
fc365ed31edde107752b4f7860b1bd7fb7da2f2d
Commit Graph

3572 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Dale
fc365ed31e Merge "Add mutex to CdmEngine for use of cert_provisioning_." into rvc-dev 2023-03-31 23:16:37 +00:00
Alex Dale
7129e9c7ec Add mutex to CdmEngine for use of cert_provisioning_. 
[ Merge of http://go/wvgerrit/167337 ]
[ PoC http://ag/21737796 ]

Bug: 258188673
Test: sts-tradefed run sts-dynamic-develop -m StsHostTestCases \
    -t android.security.sts.Bug_258188673
Test: GtsMediaTestCases
Change-Id: If71a0e7a81f376cf28688a590b6cb9dcea699545
Merged-In: If71a0e7a81f376cf28688a590b6cb9dcea699545
 2023-03-08 20:15:15 -08:00
Edwin Wong
97bbc07174 Fixed race condition in closeSession 
Merged from http://go/wvgerrit/165059
poc: http://go/ag/20978761

Fix race that corrupts mCryptoSessions std::map,
and race that occurs when CryptoSessions are used after free.

Test: poc
Test: atest MediaDrmParameterizedTests
Test: atest GtsMediaTestCases

Bug: 258189255
Change-Id: I298d3e0770ace9cd590dfaacaa4c52a0732c2fe3
Merged-In: I298d3e0770ace9cd590dfaacaa4c52a0732c2fe3
 2023-02-06 18:29:02 +00:00
Cong Lin
74a17c47f7 [automerger skipped] [RESTRICT AUTOMERGE] Clear mmapped page before releasing and re-generate am: 48cc1e57b8 -s ours am: 973140383a -s ours am: 7435874685 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14645594

Change-Id: I60876d7700679b408cd1484fe27682af748b0b96
 2021-07-13 22:04:07 +00:00
Edwin Wong
bc7b258652 [automerger skipped] [RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability. am: 51371f481f -s ours am: 5da29fc65d -s ours am: 91e37cf24d -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14127812

Change-Id: I5e8cbe4489005a0c7443b35d89fa967a256d8af8
 2021-07-13 22:04:01 +00:00
TreeHugger Robot
c7f016adf4 [automerger skipped] Merge "Revert "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability."" into pi-dev am: 28016986f5 -s ours am: dc4566325a -s ours am: 304a9d6423 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14117912

Change-Id: I1e31f15c5b16f43367f1e9b72b2fce6f484cd76a
 2021-07-13 22:03:54 +00:00
Edwin Wong
4f4a2af69c [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into oc-mr1-dev am: 1e44ea96ef -s ours am: 0914ef7cd2 -s ours am: 46c2ba1705 -s ours am: e9f480cf2b -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13497770

Change-Id: Ia33bcf60852e8222f3dffae4c92b1abc8c12bf87
 2021-07-13 22:03:50 +00:00
Edwin Wong
794a05c0ec [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into pi-dev am: 9452ee5a55 -s ours am: 18fe74f4d9 -s ours am: de20725d1a -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499845

Change-Id: I244235360cd057feb8986d07feaa05cf6d4eac27
 2021-07-13 22:03:42 +00:00
Edwin Wong
2cdf1cf43e [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 1bd967f9a8 -s ours am: 7752248af7 -s ours am: c4600c0f7d -s ours am: 9d02914fd7 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13462544

Change-Id: I4fbbd469369c9bc8e4eb7c6c06797b5680506ff8
 2021-07-13 22:03:21 +00:00
Edwin Wong
56860bc3dc [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 0558edfb31 -s ours am: ee4815ae80 -s ours am: 5e2f09293c -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13459672

Change-Id: I1cab6c1519ff1092ef54a7614a9a1b7a9aba8f01
 2021-07-13 22:03:13 +00:00
Cong Lin
7435874685 [automerger skipped] [RESTRICT AUTOMERGE] Clear mmapped page before releasing and re-generate am: 48cc1e57b8 -s ours am: 973140383a -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14645594

Change-Id: Ib33ad87432e666c9eda1ffb2cbfdd9a226350a09
 2021-07-13 21:45:32 +00:00
Edwin Wong
91e37cf24d [automerger skipped] [RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability. am: 51371f481f -s ours am: 5da29fc65d -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14127812

Change-Id: Ifc56982b3b0fd70b636ca344f083f8f027396533
 2021-07-13 21:45:30 +00:00
TreeHugger Robot
304a9d6423 [automerger skipped] Merge "Revert "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability."" into pi-dev am: 28016986f5 -s ours am: dc4566325a -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14117912

Change-Id: I6e424e4cb038d8c60915eb5920fe36e5d34baf11
 2021-07-13 21:45:25 +00:00
Edwin Wong
e9f480cf2b [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into oc-mr1-dev am: 1e44ea96ef -s ours am: 0914ef7cd2 -s ours am: 46c2ba1705 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13497770

Change-Id: I78c332b0bbb52851a59786c538d3c793439afb43
 2021-07-13 21:45:18 +00:00
Edwin Wong
de20725d1a [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into pi-dev am: 9452ee5a55 -s ours am: 18fe74f4d9 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499845

Change-Id: Ie112ddf160809e9dfd919c9c3e6f5cc071033801
 2021-07-13 21:45:12 +00:00
Edwin Wong
9d02914fd7 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 1bd967f9a8 -s ours am: 7752248af7 -s ours am: c4600c0f7d -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13462544

Change-Id: I688ac733506263c800ae5161e6218b0c954a111c
 2021-07-13 21:44:59 +00:00
Edwin Wong
5e2f09293c [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 0558edfb31 -s ours am: ee4815ae80 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13459672

Change-Id: I552dc31fba2d6813e9bb7fa94f29e4a47618ff8c
 2021-07-13 21:44:50 +00:00
Cong Lin
973140383a [automerger skipped] [RESTRICT AUTOMERGE] Clear mmapped page before releasing and re-generate am: 48cc1e57b8 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14645594

Change-Id: I9f214a1f847974771d4ad7a52857774e0876b52d
 2021-07-13 21:29:25 +00:00
Edwin Wong
5da29fc65d [automerger skipped] [RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability. am: 51371f481f -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14127812

Change-Id: Iaa8b143b5ebbb0e6ee672838c309808101b9939c
 2021-07-13 21:29:23 +00:00
TreeHugger Robot
dc4566325a [automerger skipped] Merge "Revert "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability."" into pi-dev am: 28016986f5 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14117912

Change-Id: I621378760ad6737ce90e9420950ac48da49b7bf3
 2021-07-13 21:29:21 +00:00
Edwin Wong
46c2ba1705 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into oc-mr1-dev am: 1e44ea96ef -s ours am: 0914ef7cd2 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13497770

Change-Id: I0f9e47b06bebcd404589496e8834ddbc106f749a
 2021-07-13 21:28:58 +00:00
Edwin Wong
18fe74f4d9 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into pi-dev am: 9452ee5a55 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499845

Change-Id: I1c775fc2a6e4c094e003078c167a1256d0d7c776
 2021-07-13 21:28:53 +00:00
Edwin Wong
c4600c0f7d [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 1bd967f9a8 -s ours am: 7752248af7 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13462544

Change-Id: I80f78b99b7afc28ff06270f114fd3e7929c3a7c7
 2021-07-13 21:28:38 +00:00
Edwin Wong
ee4815ae80 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: 0558edfb31 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13459672

Change-Id: I9c8b8f3b2ca9d4891d89a5327f3fca39613989af
 2021-07-13 21:28:31 +00:00
TreeHugger Robot
49462e3f0d [automerger skipped] Merge "[RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate build" into qt-dev am: 35b1be117e am: 1ea8bee2a1 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14629081

Change-Id: I78845333f380e606b7a05e34835b32b34df63df2
 2021-06-09 23:15:16 +00:00
Cong Lin
6c16096c18 [automerger skipped] [RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate am: f10acda463 am: ae49fad32b -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14629081

Change-Id: I1d4f60902b573d8f7ba76fc24406fc34db71a7d0
 2021-06-09 23:14:27 +00:00
TreeHugger Robot
1ea8bee2a1 Merge "[RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate build" into qt-dev am: 35b1be117e 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14629081

Change-Id: I6383c0dc15866b3ccad0b7b8a097fb4208f7d25d
 2021-06-09 23:02:47 +00:00
Cong Lin
ae49fad32b [RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate am: f10acda463 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14629081

Change-Id: I4bcbdfd8fe317277901c52f3e8fbd1a420b2f2b8
 2021-06-09 23:02:46 +00:00
TreeHugger Robot
35b1be117e Merge "[RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate build" into qt-dev 2021-06-09 22:40:20 +00:00
TreeHugger Robot
d8851ceda3 Merge "[RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate build" into rvc-dev 2021-06-09 21:19:20 +00:00
Edwin Wong
a9fbf4de43 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 0253cb580e -s ours am: ad1d8778e4 -s ours am: 62e23e0369 am: 85bbf55e91 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13424496

Change-Id: Id5014667cb634351d19e8b4012d2db0c7f32d365
 2021-06-02 22:47:40 +00:00
Edwin Wong
e75f7c63b5 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: a5c14b7afb -s ours am: 787f7e2158 am: d74cf5a35f -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13412308

Change-Id: I983a6944369ff77e27c8d64fba5937dffc3554de
 2021-06-02 22:47:30 +00:00
Edwin Wong
85bbf55e91 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 0253cb580e -s ours am: ad1d8778e4 -s ours am: 62e23e0369 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13424496

Change-Id: Ib88e34bacd5afb0ead74ba2a6526083366ea2822
 2021-06-02 22:25:40 +00:00
Edwin Wong
d74cf5a35f [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: a5c14b7afb -s ours am: 787f7e2158 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13412308

Change-Id: I84bf657fa0999fda46a89c02260ce31323164b9e
 2021-06-02 22:25:26 +00:00
Edwin Wong
62e23e0369 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 0253cb580e -s ours am: ad1d8778e4 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13424496

Change-Id: If6f783b3af331eedd1b9f1a1a887990978c0c52e
 2021-06-02 22:04:34 +00:00
Edwin Wong
787f7e2158 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: a5c14b7afb -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13412308

Change-Id: I3fa1dadd8d1294eff10ba86b9a7adf49e08e3bca
 2021-06-02 22:04:24 +00:00
Cong Lin
48cc1e57b8 [RESTRICT AUTOMERGE] Clear mmapped page before releasing and re-generate 
build

This is a merge of CL from widevine repo (obfuscated code only):
https://widevine-internal-review.googlesource.com/c/cdm/+/125003

Original commit message from the fix above:
"A fix in haystack which wipes out mmapped memory page before unmapping
it is made here: cl/370818768. This is to prevent potential key leaking
in L3. Obfuscated L3 is generated on top of the fix.

Additionally, new system IDs are created to track the L3 build with this
fix. These IDs are built into the updated L3 libraries in this CL also."

New L3 system IDs included in the obfuscated code:
ID      Description
22565 - Android ARM 64 L3 Field Provisioning 2021
22566 - Android ARM L3 Field Provisioning 2021
22569 - Android x86 64 L3 Field Provisioning 2021
22570 - Android x86 L3 Field Provisioning 2021

Bug: 182584472
Test: L3 unit tests
Test: GTS tests
run gts --module GtsMediaTestCases
run gts --module GtsExoPlayerTestCases
run gts --module GtsYouTubeTestCases

Change-Id: Ice316de67fac0a5f9f4f2b64d86f51cf4ff2ad07
 2021-05-19 09:52:55 -07:00
Cong Lin
f10acda463 [RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate 
build

This is a merge of CL from widevine repo (obfuscated code only):
https://widevine-internal-review.googlesource.com/c/cdm/+/124885

The source code change that produced the obfucated code is also included
in the CL above but will not be merged to Android.

Original commit message from the fix above:
"This is a security improvement against an L3 exploit b/182584472.
The change is to store RSA private key in two parts instead of one,
and load it separately when the key is needed. This will make it
more difficult to find the entire RSA key.

This CL does the key loading part only. Key splitting is done
in Haystack in CL: cl/367515385"

New L3 system IDs included in the obfuscated code:
ID     Description
22585  Android Q ARM L3 Field Provisioning 3.0
22586  Android Q ARM 64 L3 Field Provisioning 3.0
22587  Android Q x86 L3 Field Provisioning 3.0
22588  Android Q x86 64 L3 Field Provisioning 3.0

Bug: 182584472
Test: L3 unit tests
Test: GTS tests
run gts --module GtsMediaTestCases
run gts --module GtsExoPlayerTestCases
run gts --module GtsYouTubeTestCases

Change-Id: I834d3802690c2fda75cb3cfba186c41b6f5dc749
 2021-05-18 15:24:57 -07:00
Cong Lin
e4cfcab140 [RESTRICT AUTOMERGE] L3 Load RSA key from two parts and re-generate 
build

This is a merge of CL from widevine repo (obfuscated code only):
https://widevine-internal-review.googlesource.com/c/cdm/+/124623

The source code change that produced the obfucated code is also included
in the CL above but will not be merged to Android.

Original commit message from the fix above:
"This is a security improvement against an L3 exploit b/182584472.
The change is to store RSA private key in two parts instead of one,
and load it separately when the key is needed. This will make it
more difficult to find the entire RSA key.

This CL does the key loading part only. Key splitting is done
in Haystack in CL: cl/367515385"

New L3 system IDs included in the obfuscated code:
22589  Android R ARM L3 Field Provisioning 3.0
22590  Android R ARM 64 L3 Field Provisioning 3.0
22591  Android R x86 L3 Field Provisioning 3.0
22592  Android R x86 64 L3 Field Provisioning 3.0

Bug: 182584472
Test: L3 unit tests
Test: GTS tests
run gts --module GtsMediaTestCases
run gts --module GtsExoPlayerTestCases
run gts --module GtsYouTubeTestCases

Change-Id: Ie61f39f50a70ab75547d75f89d9e38264f598bc8
 2021-05-18 15:19:10 -07:00
Cong Lin
9fbcb7f1ba [automerger skipped] [RESTRICT AUTOMERGE] Refresh L3 libraries after buffer overflow fix qt-dev am: eb9a027f0a am: b6b2367e9d -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14238888

Change-Id: I0ff731accf0aba941a7b0bffd237f21ec2e34891
 2021-05-06 21:37:22 +00:00
Cong Lin
b6b2367e9d [RESTRICT AUTOMERGE] Refresh L3 libraries after buffer overflow fix qt-dev am: eb9a027f0a 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/14238888

Change-Id: I53e5d60e293cbb0bb0072bd111aea2eb0547de57
 2021-05-06 21:20:09 +00:00
Cong Lin
eb9a027f0a [RESTRICT AUTOMERGE] Refresh L3 libraries after buffer overflow fix qt-dev 
Merge of [http://go/wvgerrit/123643]. Fix included:

http://go/wvgerrit/111603
Fix L3 block offset test and re-enable buffer overflow tests

http://go/wvgerrit/111784
Fix heap overflow test in L3 and OEMCrypto ref

Test: Ran L3 unit tests
Test: GTS tests https://android-build.googleplex.com/builds/forrest/run/L68100000872640856
Bug: 182584472

Change-Id: I237f52c715e691a52256bf01fa2422aeb34e45f3
 2021-04-29 09:20:52 -07:00
Cong Lin
5ea6b86f79 [RESTRICT AUTOMERGE] Refresh L3 libraries after buffer overflow fix 
rvc-dev

Merge of [http://go/wvgerrit/123644]. Fix included:

http://go/wvgerrit/111603
Fix L3 block offset test and re-enable buffer overflow tests

http://go/wvgerrit/111784
Fix heap overflow test in L3 and OEMCrypto ref

Test: Ran L3 unit tests
Test:
gts-tradefed run gts --module GtsMediaTestCases
gts-tradefed run gts --module GtsExoPlayerTestCases
Bug: 182584472

Change-Id: I70bda559c4b5158c3461dcdfee72a8953f31a942
 2021-04-27 09:21:59 -07:00
Edwin Wong
51371f481f [RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability. 
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.

SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.

The crash was reproduced on the device before the fix.
Verified the test passes after the fix.

Test: sts
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176495665_sts64

Bug: 176495665
Bug: 176444161
Change-Id: Ib54b4a86230300e7a3e4771ac091218f0024c323
 2021-04-08 10:20:33 -07:00
TreeHugger Robot
28016986f5 Merge "Revert "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability."" into pi-dev 2021-04-08 16:53:23 +00:00
Edwin Wong
de78ca82d8 Revert "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." 
This reverts commit 93dd56bae2.

Reason for revert: <missing thread_annotation header>


[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability.

The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.

SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.

The crash was reproduced on the device before the fix.
Verified the test passes after the fix.

Test: sts
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176495665_sts64

Bug: 176495665
Bug: 176444161
Change-Id: Ieadd74a3cae024184b1a73ba8f3a640af74f1cf1
 2021-04-08 00:32:56 +00:00
Edwin Wong
e2f3b13c78 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into qt-dev am: aabd91204a am: 389837df8c -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499846

Change-Id: I57e1cda75c201ab7c722d077be6aa94b22ebb617
 2021-04-06 23:27:20 +00:00
Edwin Wong
a423695ea0 [automerger skipped] [RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability. am: 9c278174c8 am: 605ae2e217 -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499846

Change-Id: Id2b6c02ef85c826ce7b74b0a95797082b0845f5a
 2021-04-06 23:27:19 +00:00
Edwin Wong
389837df8c Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into qt-dev am: aabd91204a 
Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13499846

Change-Id: I842a3b15c82a20085825bfda63ee023feed4a653
 2021-04-06 23:06:29 +00:00
Edwin Wong
0914ef7cd2 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix WVCryptoPlugin use after free vulnerability." into oc-mr1-dev am: 1e44ea96ef -s ours 
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/vendor/widevine/+/13497770

Change-Id: I9d8da4ae123a4c9e963923a89c87a5b9172230b2
 2021-04-06 23:06:28 +00:00