diff options
| author | Mike Lockwood <lockwood@google.com> | 2014-12-17 23:24:29 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2014-12-17 23:24:29 +0000 |
| commit | 93830b75204207addee67705016aab1a34eee5f6 (patch) | |
| tree | b16f3facf3860478db0fe9a55523b85ce6009cd6 /media/mtp | |
| parent | 85aca658ac7d20584b0647427256df50a5f243ef (diff) | |
| parent | 562b98ec7edf9303f4c7d8da7e81171b621d3849 (diff) | |
| download | frameworks_av-93830b75204207addee67705016aab1a34eee5f6.zip frameworks_av-93830b75204207addee67705016aab1a34eee5f6.tar.gz frameworks_av-93830b75204207addee67705016aab1a34eee5f6.tar.bz2 | |
am 562b98ec: am e48cf5b8: Fix bounds checking for GetPartialObject command
* commit '562b98ec7edf9303f4c7d8da7e81171b621d3849':
Fix bounds checking for GetPartialObject command
Diffstat (limited to 'media/mtp')
| -rw-r--r-- | media/mtp/MtpServer.cpp | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp index 931a09d..e4e16f2 100644 --- a/media/mtp/MtpServer.cpp +++ b/media/mtp/MtpServer.cpp @@ -819,18 +819,24 @@ MtpResponseCode MtpServer::doGetThumb() { MtpResponseCode MtpServer::doGetPartialObject(MtpOperationCode operation) { if (!hasStorage()) return MTP_RESPONSE_INVALID_OBJECT_HANDLE; - if (mRequest.getParameterCount() < 4) - return MTP_RESPONSE_INVALID_PARAMETER; MtpObjectHandle handle = mRequest.getParameter(1); uint64_t offset; uint32_t length; offset = mRequest.getParameter(2); if (operation == MTP_OPERATION_GET_PARTIAL_OBJECT_64) { + // MTP_OPERATION_GET_PARTIAL_OBJECT_64 takes 4 arguments + if (mRequest.getParameterCount() < 4) + return MTP_RESPONSE_INVALID_PARAMETER; + // android extension with 64 bit offset uint64_t offset2 = mRequest.getParameter(3); offset = offset | (offset2 << 32); length = mRequest.getParameter(4); } else { + // MTP_OPERATION_GET_PARTIAL_OBJECT takes 3 arguments + if (mRequest.getParameterCount() < 3) + return MTP_RESPONSE_INVALID_PARAMETER; + // standard GetPartialObject length = mRequest.getParameter(3); } |