From d72b2aa86e19644bbaa72039b3a3044390ba0ecd Mon Sep 17 00:00:00 2001
From: Sangkyu Lee <sk82.lee@lge.com>
Date: Fri, 8 Feb 2013 16:26:39 +0900
Subject: Avoid invalid memory access when using extractMetadata()

BpMediaMetadataRetriever::extractMetadata() returns a string
which is returned by readCString() function of the reply parcel object.
However, the parcel object is destroyed at the end of the
extractMetadata() function, and so the returned pointer is invalid.
This patch fixes this problem by storing the metadata string value.

Change-Id: I2a2ccba78246175b2845a237679d6cebe881e83b
Signed-off-by: Sangkyu Lee <sk82.lee@lge.com>
---
 media/libmedia/IMediaMetadataRetriever.cpp | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

(limited to 'media/libmedia/IMediaMetadataRetriever.cpp')

diff --git a/media/libmedia/IMediaMetadataRetriever.cpp b/media/libmedia/IMediaMetadataRetriever.cpp
index 7e6d54b..bb066a0 100644
--- a/media/libmedia/IMediaMetadataRetriever.cpp
+++ b/media/libmedia/IMediaMetadataRetriever.cpp
@@ -20,6 +20,7 @@
 #include <binder/Parcel.h>
 #include <media/IMediaMetadataRetriever.h>
 #include <utils/String8.h>
+#include <utils/KeyedVector.h>
 
 // The binder is supposed to propagate the scheduler group across
 // the binder interface so that remote calls are executed with
@@ -161,8 +162,22 @@ public:
         if (ret != NO_ERROR) {
             return NULL;
         }
-        return reply.readCString();
+        const char* str = reply.readCString();
+        if (str != NULL) {
+            String8 value(str);
+            if (mMetadata.indexOfKey(keyCode) < 0) {
+                mMetadata.add(keyCode, value);
+            } else {
+                mMetadata.replaceValueFor(keyCode, value);
+            }
+            return mMetadata.valueFor(keyCode).string();
+        } else {
+            return NULL;
+        }
     }
+
+private:
+    KeyedVector<int, String8> mMetadata;
 };
 
 IMPLEMENT_META_INTERFACE(MediaMetadataRetriever, "android.media.IMediaMetadataRetriever");
-- 
cgit v1.1