diff options
author | Mike Lockwood <lockwood@google.com> | 2014-11-13 16:43:35 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2014-11-13 16:43:35 +0000 |
commit | e418cfae0970d1abe60b8cc681aa8c8a828b3769 (patch) | |
tree | 4578b428d6a2bad432207238c48444541684e23e /media/mtp/MtpDevice.cpp | |
parent | cf957fb7c4a5ca845bfb4639f8b551aeec0075ca (diff) | |
parent | 869e0798bbb51af570b4d6ef750f2c21e6b94c8a (diff) | |
download | frameworks_av-e418cfae0970d1abe60b8cc681aa8c8a828b3769.zip frameworks_av-e418cfae0970d1abe60b8cc681aa8c8a828b3769.tar.gz frameworks_av-e418cfae0970d1abe60b8cc681aa8c8a828b3769.tar.bz2 |
am 869e0798: Merge "MTP: add strict bounds checking for all incoming packets" into lmp-mr1-dev
* commit '869e0798bbb51af570b4d6ef750f2c21e6b94c8a':
MTP: add strict bounds checking for all incoming packets
Diffstat (limited to 'media/mtp/MtpDevice.cpp')
-rw-r--r-- | media/mtp/MtpDevice.cpp | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/media/mtp/MtpDevice.cpp b/media/mtp/MtpDevice.cpp index d6d5dd5..e0d679d 100644 --- a/media/mtp/MtpDevice.cpp +++ b/media/mtp/MtpDevice.cpp @@ -313,8 +313,10 @@ MtpDeviceInfo* MtpDevice::getDeviceInfo() { MtpResponseCode ret = readResponse(); if (ret == MTP_RESPONSE_OK) { MtpDeviceInfo* info = new MtpDeviceInfo; - info->read(mData); - return info; + if (info->read(mData)) + return info; + else + delete info; } return NULL; } @@ -346,8 +348,10 @@ MtpStorageInfo* MtpDevice::getStorageInfo(MtpStorageID storageID) { MtpResponseCode ret = readResponse(); if (ret == MTP_RESPONSE_OK) { MtpStorageInfo* info = new MtpStorageInfo(storageID); - info->read(mData); - return info; + if (info->read(mData)) + return info; + else + delete info; } return NULL; } @@ -385,8 +389,10 @@ MtpObjectInfo* MtpDevice::getObjectInfo(MtpObjectHandle handle) { MtpResponseCode ret = readResponse(); if (ret == MTP_RESPONSE_OK) { MtpObjectInfo* info = new MtpObjectInfo(handle); - info->read(mData); - return info; + if (info->read(mData)) + return info; + else + delete info; } return NULL; } @@ -547,8 +553,10 @@ MtpProperty* MtpDevice::getDevicePropDesc(MtpDeviceProperty code) { MtpResponseCode ret = readResponse(); if (ret == MTP_RESPONSE_OK) { MtpProperty* property = new MtpProperty; - property->read(mData); - return property; + if (property->read(mData)) + return property; + else + delete property; } return NULL; } @@ -566,15 +574,17 @@ MtpProperty* MtpDevice::getObjectPropDesc(MtpObjectProperty code, MtpObjectForma MtpResponseCode ret = readResponse(); if (ret == MTP_RESPONSE_OK) { MtpProperty* property = new MtpProperty; - property->read(mData); - return property; + if (property->read(mData)) + return property; + else + delete property; } return NULL; } bool MtpDevice::readObject(MtpObjectHandle handle, bool (* callback)(void* data, int offset, int length, void* clientData), - int objectSize, void* clientData) { + size_t objectSize, void* clientData) { Mutex::Autolock autoLock(mMutex); bool result = false; |