From 9fa803be109339e8ebfa7f338bf18858f49af709 Mon Sep 17 00:00:00 2001
From: Elliott Hughes <enh@google.com>
Date: Thu, 5 Jun 2014 10:38:30 -0700
Subject: [LP64] Fix access to MediaAlbumArt.

The mSize field is a uint32_t, not a long.

Change-Id: Id3b9e6049e8998840d33fa886b676db2a8022064
---
 media/jni/android_media_MediaScanner.cpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'media/jni')

diff --git a/media/jni/android_media_MediaScanner.cpp b/media/jni/android_media_MediaScanner.cpp
index 84028b7..6730e0a 100644
--- a/media/jni/android_media_MediaScanner.cpp
+++ b/media/jni/android_media_MediaScanner.cpp
@@ -21,6 +21,7 @@
 #include <utils/threads.h>
 #include <media/mediascanner.h>
 #include <media/stagefright/StagefrightMediaScanner.h>
+#include <private/media/VideoFrame.h>
 
 #include "jni.h"
 #include "JNIHelp.h"
@@ -347,21 +348,21 @@ android_media_MediaScanner_extractAlbumArt(
     }
 
     int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);
-    char* data = mp->extractAlbumArt(fd);
-    if (!data) {
+    MediaAlbumArt* mediaAlbumArt =
+            reinterpret_cast<MediaAlbumArt*>(mp->extractAlbumArt(fd));
+    if (mediaAlbumArt != NULL) {
         return NULL;
     }
-    long len = *((long*)data);
 
-    jbyteArray array = env->NewByteArray(len);
+    jbyteArray array = env->NewByteArray(mediaAlbumArt->mSize);
     if (array != NULL) {
         jbyte* bytes = env->GetByteArrayElements(array, NULL);
-        memcpy(bytes, data + 4, len);
+        memcpy(bytes, &mediaAlbumArt->mData[0], mediaAlbumArt->mSize);
         env->ReleaseByteArrayElements(array, bytes, 0);
     }
 
 done:
-    free(data);
+    free(mediaAlbumArt);
     // if NewByteArray() returned NULL, an out-of-memory
     // exception will have been raised. I just want to
     // return null in that case.
-- 
cgit v1.1