diff options
| author | Mike Lockwood <lockwood@google.com> | 2014-12-17 23:18:21 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2014-12-17 23:18:21 +0000 |
| commit | 562b98ec7edf9303f4c7d8da7e81171b621d3849 (patch) | |
| tree | e4c28928702a1b75d4a67958bdccdca0d7e73c61 /media/mtp | |
| parent | d33712d7ec5dcf427cc0be9b7d2ca1c99823c8e6 (diff) | |
| parent | e48cf5b8f823c30af93577c1e380d752ac69b871 (diff) | |
| download | frameworks_av-562b98ec7edf9303f4c7d8da7e81171b621d3849.zip frameworks_av-562b98ec7edf9303f4c7d8da7e81171b621d3849.tar.gz frameworks_av-562b98ec7edf9303f4c7d8da7e81171b621d3849.tar.bz2 | |
am e48cf5b8: Fix bounds checking for GetPartialObject command
* commit 'e48cf5b8f823c30af93577c1e380d752ac69b871':
Fix bounds checking for GetPartialObject command
Diffstat (limited to 'media/mtp')
| -rw-r--r-- | media/mtp/MtpServer.cpp | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp index 931a09d..e4e16f2 100644 --- a/media/mtp/MtpServer.cpp +++ b/media/mtp/MtpServer.cpp @@ -819,18 +819,24 @@ MtpResponseCode MtpServer::doGetThumb() { MtpResponseCode MtpServer::doGetPartialObject(MtpOperationCode operation) { if (!hasStorage()) return MTP_RESPONSE_INVALID_OBJECT_HANDLE; - if (mRequest.getParameterCount() < 4) - return MTP_RESPONSE_INVALID_PARAMETER; MtpObjectHandle handle = mRequest.getParameter(1); uint64_t offset; uint32_t length; offset = mRequest.getParameter(2); if (operation == MTP_OPERATION_GET_PARTIAL_OBJECT_64) { + // MTP_OPERATION_GET_PARTIAL_OBJECT_64 takes 4 arguments + if (mRequest.getParameterCount() < 4) + return MTP_RESPONSE_INVALID_PARAMETER; + // android extension with 64 bit offset uint64_t offset2 = mRequest.getParameter(3); offset = offset | (offset2 << 32); length = mRequest.getParameter(4); } else { + // MTP_OPERATION_GET_PARTIAL_OBJECT takes 3 arguments + if (mRequest.getParameterCount() < 3) + return MTP_RESPONSE_INVALID_PARAMETER; + // standard GetPartialObject length = mRequest.getParameter(3); } |