From ab063847e6e893740749029a04cce1f6b7345ed5 Mon Sep 17 00:00:00 2001 From: Mike Lockwood Date: Wed, 12 Nov 2014 14:20:06 -0800 Subject: MTP: add strict bounds checking for all incoming packets Previously we did not sanity check incoming MTP packets, which could result in crashes due to reading off the edge of a packet. Now all MTP packet getter functions return a boolean result (true for OK, false for reading off the edge of the packet) and we now return errors for malformed packets. Bug: 18113092 Change-Id: Ic7623ee96f00652bdfb4f66acb16a93db5a1c105 --- media/mtp/MtpPacket.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'media/mtp/MtpPacket.h') diff --git a/media/mtp/MtpPacket.h b/media/mtp/MtpPacket.h index 0ffb1d3..037722a 100644 --- a/media/mtp/MtpPacket.h +++ b/media/mtp/MtpPacket.h @@ -28,11 +28,11 @@ class MtpPacket { protected: uint8_t* mBuffer; // current size of the buffer - int mBufferSize; + size_t mBufferSize; // number of bytes to add when resizing the buffer - int mAllocationIncrement; + size_t mAllocationIncrement; // size of the data in the packet - int mPacketSize; + size_t mPacketSize; public: MtpPacket(int bufferSize); @@ -41,7 +41,7 @@ public: // sets packet size to the default container size and sets buffer to zero virtual void reset(); - void allocate(int length); + void allocate(size_t length); void dump(); void copyFrom(const MtpPacket& src); -- cgit v1.1