Code: status_t MediaPlayerService::Client::setNextPlayer(const sp<IMediaPlayer>& player) {

     ALOGV("setNextPlayer");
     Mutex::Autolock l(mLock);
     sp<Client> c = static_cast<Client*>(player.get());
     mNextClient = c;
 
     if (c != NULL) {
 if (mAudioOutput != NULL) {
            mAudioOutput->setNextOutput(c->mAudioOutput);
 } else if ((mPlayer != NULL) && !mPlayer->hardwareOutput()) {
            ALOGE("no current audio output");
 }

 if ((mPlayer != NULL) && (mNextClient->getPlayer() != NULL)) {
            mPlayer->setNextPlayer(mNextClient->getPlayer());
 }
 }

 return OK;
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain static_cast operation, which allows attackers to gain privileges via a crafted application, aka internal bug 30204103.
Commit Message: MediaPlayerService: avoid invalid static cast

Bug: 30204103
Change-Id: Ie0dd3568a375f1e9fed8615ad3d85184bcc99028
(cherry picked from commit ee0a0e39acdcf8f97e0d6945c31ff36a06a36e9d)
