summaryrefslogtreecommitdiffstats
path: root/media/libstagefright
diff options
context:
space:
mode:
authorFlanker <i@flanker017.me>2015-09-29 06:28:47 +0000
committerAndroid Git Automerger <android-git-automerger@android.com>2015-09-29 06:28:47 +0000
commitbdaee5eaa345ee9b1e5ddcb921565c4d127ceb8d (patch)
tree1f1c05590fa945764e44dacc9410d951a7ff9a41 /media/libstagefright
parent4554ffd7a1c4bc6973c11c00f5a19aa260e18100 (diff)
parent3737a3fa121796131ea5b782230e65dad9ccf90f (diff)
downloadframeworks_av-bdaee5eaa345ee9b1e5ddcb921565c4d127ceb8d.zip
frameworks_av-bdaee5eaa345ee9b1e5ddcb921565c4d127ceb8d.tar.gz
frameworks_av-bdaee5eaa345ee9b1e5ddcb921565c4d127ceb8d.tar.bz2
am 3737a3fa: DO NOT MERGE stagefright: fix AMessage::FromParcel
* commit '3737a3fa121796131ea5b782230e65dad9ccf90f': DO NOT MERGE stagefright: fix AMessage::FromParcel
Diffstat (limited to 'media/libstagefright')
-rw-r--r--media/libstagefright/foundation/AMessage.cpp25
1 files changed, 22 insertions, 3 deletions
diff --git a/media/libstagefright/foundation/AMessage.cpp b/media/libstagefright/foundation/AMessage.cpp
index dc42f91..1300f16 100644
--- a/media/libstagefright/foundation/AMessage.cpp
+++ b/media/libstagefright/foundation/AMessage.cpp
@@ -453,13 +453,23 @@ sp<AMessage> AMessage::FromParcel(const Parcel &parcel) {
sp<AMessage> msg = new AMessage(what);
msg->mNumItems = static_cast<size_t>(parcel.readInt32());
+ if (msg->mNumItems > kMaxNumItems) {
+ ALOGE("Too large number of items clipped.");
+ msg->mNumItems = kMaxNumItems;
+ }
for (size_t i = 0; i < msg->mNumItems; ++i) {
Item *item = &msg->mItems[i];
- item->mName = AAtomizer::Atomize(parcel.readCString());
- item->mType = static_cast<Type>(parcel.readInt32());
+ const char *name = parcel.readCString();
+ if (name == NULL) {
+ ALOGE("Failed reading name for an item. Parsing aborted.");
+ msg->mNumItems = i;
+ break;
+ }
+ item->mName = AAtomizer::Atomize(name);
+ item->mType = static_cast<Type>(parcel.readInt32());
switch (item->mType) {
case kTypeInt32:
{
@@ -493,7 +503,16 @@ sp<AMessage> AMessage::FromParcel(const Parcel &parcel) {
case kTypeString:
{
- item->u.stringValue = new AString(parcel.readCString());
+ const char *stringValue = parcel.readCString();
+ if (stringValue == NULL) {
+ ALOGE("Failed reading string value from a parcel. "
+ "Parsing aborted.");
+ msg->mNumItems = i;
+ continue;
+ // The loop will terminate subsequently.
+ } else {
+ item->u.stringValue = new AString(stringValue);
+ }
break;
}