diff options
author | Mike Lockwood <lockwood@android.com> | 2011-04-25 12:56:21 -0700 |
---|---|---|
committer | Mike Lockwood <lockwood@android.com> | 2011-04-25 13:36:11 -0700 |
commit | c3f16e5620c090aeb75c0836572a8b913a4ef864 (patch) | |
tree | a888617667df3f7deb35d7123f8963ef23e9ed96 | |
parent | c5182e31b23dc381d21ef43b7f7d682ffc54bd79 (diff) | |
download | frameworks_av-c3f16e5620c090aeb75c0836572a8b913a4ef864.zip frameworks_av-c3f16e5620c090aeb75c0836572a8b913a4ef864.tar.gz frameworks_av-c3f16e5620c090aeb75c0836572a8b913a4ef864.tar.bz2 |
MTP: Fix file descriptor leak in file editing extensions
Change-Id: I6d0de5efe705d8060bbfd526c6880dc995a3aa30
Signed-off-by: Mike Lockwood <lockwood@android.com>
-rw-r--r-- | media/mtp/MtpServer.cpp | 31 | ||||
-rw-r--r-- | media/mtp/MtpServer.h | 22 |
2 files changed, 29 insertions, 24 deletions
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp index ff4009c..b744b5b 100644 --- a/media/mtp/MtpServer.cpp +++ b/media/mtp/MtpServer.cpp @@ -270,12 +270,7 @@ void MtpServer::sendEvent(MtpEventCode code, uint32_t param1) { void MtpServer::addEditObject(MtpObjectHandle handle, MtpString& path, uint64_t size, MtpObjectFormat format, int fd) { - ObjectEdit* edit = new ObjectEdit; - edit->handle = handle; - edit->path = path; - edit->size = size; - edit->format = format; - edit->fd = fd; + ObjectEdit* edit = new ObjectEdit(handle, path, size, format, fd); mObjectEditList.add(edit); } @@ -283,7 +278,7 @@ MtpServer::ObjectEdit* MtpServer::getEditObject(MtpObjectHandle handle) { int count = mObjectEditList.size(); for (int i = 0; i < count; i++) { ObjectEdit* edit = mObjectEditList[i]; - if (edit->handle == handle) return edit; + if (edit->mHandle == handle) return edit; } return NULL; } @@ -292,7 +287,7 @@ void MtpServer::removeEditObject(MtpObjectHandle handle) { int count = mObjectEditList.size(); for (int i = 0; i < count; i++) { ObjectEdit* edit = mObjectEditList[i]; - if (edit->handle == handle) { + if (edit->mHandle == handle) { delete edit; mObjectEditList.removeAt(i); return; @@ -302,7 +297,7 @@ void MtpServer::removeEditObject(MtpObjectHandle handle) { } void MtpServer::commitEdit(ObjectEdit* edit) { - mDatabase->endSendObject((const char *)edit->path, edit->handle, edit->format, true); + mDatabase->endSendObject((const char *)edit->mPath, edit->mHandle, edit->mFormat, true); } @@ -681,7 +676,7 @@ MtpResponseCode MtpServer::doGetObjectInfo() { uint32_t size = info.mCompressedSize; ObjectEdit* edit = getEditObject(handle); if (edit) - size = (edit->size > 0xFFFFFFFFLL ? 0xFFFFFFFF : (uint32_t)edit->size); + size = (edit->mSize > 0xFFFFFFFFLL ? 0xFFFFFFFF : (uint32_t)edit->mSize); mData.putUInt32(size); mData.putUInt16(info.mThumbFormat); @@ -1059,8 +1054,8 @@ MtpResponseCode MtpServer::doSendPartialObject() { } // can't start writing past the end of the file - if (offset > edit->size) { - LOGD("writing past end of object, offset: %lld, edit->size: %lld", offset, edit->size); + if (offset > edit->mSize) { + LOGD("writing past end of object, offset: %lld, edit->mSize: %lld", offset, edit->mSize); return MTP_RESPONSE_GENERAL_ERROR; } @@ -1071,10 +1066,10 @@ MtpResponseCode MtpServer::doSendPartialObject() { // reset so we don't attempt to send this back mData.reset(); - const char* filePath = (const char *)edit->path; + const char* filePath = (const char *)edit->mPath; LOGV("receiving partial %s %lld %ld\n", filePath, offset, length); mtp_file_range mfr; - mfr.fd = edit->fd; + mfr.fd = edit->mFD; mfr.offset = offset; mfr.length = length; @@ -1090,8 +1085,8 @@ MtpResponseCode MtpServer::doSendPartialObject() { } mResponse.setParameter(1, length); uint64_t end = offset + length; - if (end > edit->size) { - edit->size = end; + if (end > edit->mSize) { + edit->mSize = end; } return MTP_RESPONSE_OK; } @@ -1107,10 +1102,10 @@ MtpResponseCode MtpServer::doTruncateObject() { uint64_t offset = mRequest.getParameter(2); uint64_t offset2 = mRequest.getParameter(3); offset |= (offset2 << 32); - if (ftruncate(edit->fd, offset) != 0) { + if (ftruncate(edit->mFD, offset) != 0) { return MTP_RESPONSE_GENERAL_ERROR; } else { - edit->size = offset; + edit->mSize = offset; return MTP_RESPONSE_OK; } } diff --git a/media/mtp/MtpServer.h b/media/mtp/MtpServer.h index 35a38e7..b06eb28 100644 --- a/media/mtp/MtpServer.h +++ b/media/mtp/MtpServer.h @@ -67,12 +67,22 @@ private: // represents an MTP object that is being edited using the android extensions // for direct editing (BeginEditObject, SendPartialObject, TruncateObject and EndEditObject) - struct ObjectEdit { - MtpObjectHandle handle; - MtpString path; - uint64_t size; - MtpObjectFormat format; - int fd; + class ObjectEdit { + public: + MtpObjectHandle mHandle; + MtpString mPath; + uint64_t mSize; + MtpObjectFormat mFormat; + int mFD; + + ObjectEdit(MtpObjectHandle handle, const char* path, uint64_t size, + MtpObjectFormat format, int fd) + : mHandle(handle), mPath(path), mSize(size), mFormat(format), mFD(fd) { + } + + virtual ~ObjectEdit() { + close(mFD); + } }; Vector<ObjectEdit*> mObjectEditList; |