Local memory disclosure via decrypt pointer overflow

Out-of-bounds read in Android 8.1 through 11 allows local users to disclose process memory through a crafted ClearKey decrypt request. CryptoPlugin::decrypt adds an attacker-controlled offset to the source buffer before validating the resulting pointer; integer wraparound bypasses the base-size check and copies memory outside the source buffer to the destination. Exploitation requires local code execution but no additional execution privileges or user interaction, and the reported consequence is memory disclosure only.