diff options
author | Marco Nelissen <marcone@google.com> | 2015-05-07 00:28:00 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-05-07 00:28:00 +0000 |
commit | d7446564c3e469aea1bba5460ff1fb9441f9fc09 (patch) | |
tree | a458625c26498b84fbbfb53d7d583d64588d0616 /media/libmedia/IMediaHTTPConnection.cpp | |
parent | 4c85e16c9f7cbd9e9fa4713d62ed2c7f4da2f7d3 (diff) | |
parent | 1e5670abf9c1b714819ab6ec529a6bc19cbdacf4 (diff) | |
download | frameworks_av-d7446564c3e469aea1bba5460ff1fb9441f9fc09.zip frameworks_av-d7446564c3e469aea1bba5460ff1fb9441f9fc09.tar.gz frameworks_av-d7446564c3e469aea1bba5460ff1fb9441f9fc09.tar.bz2 |
am 1e5670ab: am 296dc670: am d8e41553: am bd28ac74: am 59cea261: Add some sanity checks
* commit '1e5670abf9c1b714819ab6ec529a6bc19cbdacf4':
Add some sanity checks
Diffstat (limited to 'media/libmedia/IMediaHTTPConnection.cpp')
-rw-r--r-- | media/libmedia/IMediaHTTPConnection.cpp | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/media/libmedia/IMediaHTTPConnection.cpp b/media/libmedia/IMediaHTTPConnection.cpp index 7e26ee6..a5a3714 100644 --- a/media/libmedia/IMediaHTTPConnection.cpp +++ b/media/libmedia/IMediaHTTPConnection.cpp @@ -24,6 +24,7 @@ #include <binder/Parcel.h> #include <utils/String8.h> #include <media/stagefright/foundation/ADebug.h> +#include <media/stagefright/MediaErrors.h> namespace android { @@ -106,11 +107,18 @@ struct BpMediaHTTPConnection : public BpInterface<IMediaHTTPConnection> { return UNKNOWN_ERROR; } - int32_t len = reply.readInt32(); + size_t len = reply.readInt32(); - if (len > 0) { - memcpy(buffer, mMemory->pointer(), len); + if (len > size) { + ALOGE("requested %zu, got %zu", size, len); + return ERROR_OUT_OF_RANGE; } + if (len > mMemory->size()) { + ALOGE("got %zu, but memory has %zu", len, mMemory->size()); + return ERROR_OUT_OF_RANGE; + } + + memcpy(buffer, mMemory->pointer(), len); return len; } |