diff options
Diffstat (limited to 'media/mtp/MtpRequestPacket.cpp')
-rw-r--r-- | media/mtp/MtpRequestPacket.cpp | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/media/mtp/MtpRequestPacket.cpp b/media/mtp/MtpRequestPacket.cpp index 0e58e01..40b11b0 100644 --- a/media/mtp/MtpRequestPacket.cpp +++ b/media/mtp/MtpRequestPacket.cpp @@ -27,7 +27,8 @@ namespace android { MtpRequestPacket::MtpRequestPacket() - : MtpPacket(512) + : MtpPacket(512), + mParameterCount(0) { } @@ -37,10 +38,21 @@ MtpRequestPacket::~MtpRequestPacket() { #ifdef MTP_DEVICE int MtpRequestPacket::read(int fd) { int ret = ::read(fd, mBuffer, mBufferSize); - if (ret >= 0) + if (ret < 0) { + // file read error + return ret; + } + + // request packet should have 12 byte header followed by 0 to 5 32-bit arguments + if (ret >= MTP_CONTAINER_HEADER_SIZE + && ret <= MTP_CONTAINER_HEADER_SIZE + 5 * sizeof(uint32_t) + && ((ret - MTP_CONTAINER_HEADER_SIZE) & 3) == 0) { mPacketSize = ret; - else - mPacketSize = 0; + mParameterCount = (ret - MTP_CONTAINER_HEADER_SIZE) / sizeof(uint32_t); + } else { + ALOGE("Malformed MTP request packet"); + ret = -1; + } return ret; } #endif |