summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2015-05-06 20:57:01 +0000
committerAndroid Git Automerger <android-git-automerger@android.com>2015-05-06 20:57:01 +0000
commitbd28ac7471e2c7cab0ce9df4c2d5a295adc163a1 (patch)
tree25cbb9d1649a9ead2484d56fef1cd3b9840d12d8 /media
parent2f47bb53f65e34ba9cff66106390351440b9409b (diff)
parent59cea2616269f34b1f3d046995efd8da42cd5549 (diff)
downloadframeworks_av-bd28ac7471e2c7cab0ce9df4c2d5a295adc163a1.zip
frameworks_av-bd28ac7471e2c7cab0ce9df4c2d5a295adc163a1.tar.gz
frameworks_av-bd28ac7471e2c7cab0ce9df4c2d5a295adc163a1.tar.bz2
am 59cea261: Add some sanity checks
* commit '59cea2616269f34b1f3d046995efd8da42cd5549': Add some sanity checks
Diffstat (limited to 'media')
-rw-r--r--media/libmedia/IMediaHTTPConnection.cpp14
1 files changed, 11 insertions, 3 deletions
diff --git a/media/libmedia/IMediaHTTPConnection.cpp b/media/libmedia/IMediaHTTPConnection.cpp
index 7e26ee6..a5a3714 100644
--- a/media/libmedia/IMediaHTTPConnection.cpp
+++ b/media/libmedia/IMediaHTTPConnection.cpp
@@ -24,6 +24,7 @@
#include <binder/Parcel.h>
#include <utils/String8.h>
#include <media/stagefright/foundation/ADebug.h>
+#include <media/stagefright/MediaErrors.h>
namespace android {
@@ -106,11 +107,18 @@ struct BpMediaHTTPConnection : public BpInterface<IMediaHTTPConnection> {
return UNKNOWN_ERROR;
}
- int32_t len = reply.readInt32();
+ size_t len = reply.readInt32();
- if (len > 0) {
- memcpy(buffer, mMemory->pointer(), len);
+ if (len > size) {
+ ALOGE("requested %zu, got %zu", size, len);
+ return ERROR_OUT_OF_RANGE;
}
+ if (len > mMemory->size()) {
+ ALOGE("got %zu, but memory has %zu", len, mMemory->size());
+ return ERROR_OUT_OF_RANGE;
+ }
+
+ memcpy(buffer, mMemory->pointer(), len);
return len;
}