diff options
author | Mike Lockwood <lockwood@google.com> | 2014-11-12 14:20:06 -0800 |
---|---|---|
committer | Mike Lockwood <lockwood@google.com> | 2014-11-12 16:08:37 -0800 |
commit | ab063847e6e893740749029a04cce1f6b7345ed5 (patch) | |
tree | 8b840e9152cfa638aa354a0379962a89914e0006 /media/mtp/MtpProperty.h | |
parent | 745602d87607521f4fe84c4f3a6388fbdb6a867c (diff) | |
download | frameworks_av-ab063847e6e893740749029a04cce1f6b7345ed5.zip frameworks_av-ab063847e6e893740749029a04cce1f6b7345ed5.tar.gz frameworks_av-ab063847e6e893740749029a04cce1f6b7345ed5.tar.bz2 |
MTP: add strict bounds checking for all incoming packets
Previously we did not sanity check incoming MTP packets,
which could result in crashes due to reading off the edge of a packet.
Now all MTP packet getter functions return a boolean result
(true for OK, false for reading off the edge of the packet)
and we now return errors for malformed packets.
Bug: 18113092
Change-Id: Ic7623ee96f00652bdfb4f66acb16a93db5a1c105
Diffstat (limited to 'media/mtp/MtpProperty.h')
-rw-r--r-- | media/mtp/MtpProperty.h | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/media/mtp/MtpProperty.h b/media/mtp/MtpProperty.h index 06ca56e..2e2ead1 100644 --- a/media/mtp/MtpProperty.h +++ b/media/mtp/MtpProperty.h @@ -49,9 +49,9 @@ public: MtpPropertyValue mCurrentValue; // for array types - int mDefaultArrayLength; + uint32_t mDefaultArrayLength; MtpPropertyValue* mDefaultArrayValues; - int mCurrentArrayLength; + uint32_t mCurrentArrayLength; MtpPropertyValue* mCurrentArrayValues; enum { @@ -70,7 +70,7 @@ public: MtpPropertyValue mStepSize; // for enum form - int mEnumLength; + uint16_t mEnumLength; MtpPropertyValue* mEnumValues; public: @@ -83,7 +83,7 @@ public: inline MtpPropertyCode getPropertyCode() const { return mCode; } - void read(MtpDataPacket& packet); + bool read(MtpDataPacket& packet); void write(MtpDataPacket& packet); void setDefaultValue(const uint16_t* string); @@ -102,11 +102,11 @@ public: } private: - void readValue(MtpDataPacket& packet, MtpPropertyValue& value); + bool readValue(MtpDataPacket& packet, MtpPropertyValue& value); void writeValue(MtpDataPacket& packet, MtpPropertyValue& value); - MtpPropertyValue* readArrayValues(MtpDataPacket& packet, int& length); + MtpPropertyValue* readArrayValues(MtpDataPacket& packet, uint32_t& length); void writeArrayValues(MtpDataPacket& packet, - MtpPropertyValue* values, int length); + MtpPropertyValue* values, uint32_t length); }; }; // namespace android |