libmedia: check NULL pointer at binder receiver side. (2afac0c7) · Commits · e / os / android_frameworks_av

media/libmedia/ICrypto.cpp

+9 −1

Original line number	Diff line number	Diff line
		@@ -261,7 +261,11 @@ status_t BnCrypto::onTransact(
		CHECK_INTERFACE(ICrypto, data, reply);

		const char *mime = data.readCString();
		if (mime == NULL) {
		reply->writeInt32(BAD_VALUE);
		} else {
		reply->writeInt32(requiresSecureDecoderComponent(mime));
		}

		return OK;
		}
		@@ -282,6 +286,10 @@ status_t BnCrypto::onTransact(
		size_t totalSize = data.readInt32();
		sp<IMemory> sharedBuffer =
		interface_cast<IMemory>(data.readStrongBinder());
		if (sharedBuffer == NULL) {
		reply->writeInt32(BAD_VALUE);
		return OK;
		}
		int32_t offset = data.readInt32();

		int32_t numSubSamples = data.readInt32();

+8 −0

Original line number	Diff line number	Diff line
		@@ -157,6 +157,10 @@ status_t BnMediaCodecList::onTransact(
		{
		CHECK_INTERFACE(IMediaCodecList, data, reply);
		const char *type = data.readCString();
		if (type == NULL) {
		reply->writeInt32(NAME_NOT_FOUND);
		return NO_ERROR;
		}
		bool isEncoder = static_cast<bool>(data.readInt32());
		size_t startIndex = static_cast<size_t>(data.readInt32());
		ssize_t index = findCodecByType(type, isEncoder, startIndex);
		@@ -172,6 +176,10 @@ status_t BnMediaCodecList::onTransact(
		{
		CHECK_INTERFACE(IMediaCodecList, data, reply);
		const char *name = data.readCString();
		if (name == NULL) {
		reply->writeInt32(NAME_NOT_FOUND);
		return NO_ERROR;
		}
		ssize_t index = findCodecByName(name);
		if (index > INT32_MAX \|\| index < 0) {
		index = NAME_NOT_FOUND;

+10 −1

Original line number	Diff line number	Diff line
		@@ -224,6 +224,11 @@ status_t BnMediaMetadataRetriever::onTransact(

		const char* srcUrl = data.readCString();

		if (httpService == NULL \|\| srcUrl == NULL) {
		reply->writeInt32(BAD_VALUE);
		return NO_ERROR;
		}

		KeyedVector<String8, String8> headers;
		size_t numHeaders = (size_t) data.readInt64();
		for (size_t i = 0; i < numHeaders; ++i) {
		@@ -250,7 +255,11 @@ status_t BnMediaMetadataRetriever::onTransact(
		CHECK_INTERFACE(IMediaMetadataRetriever, data, reply);
		sp<IDataSource> source =
		interface_cast<IDataSource>(data.readStrongBinder());
		if (source == NULL) {
		reply->writeInt32(BAD_VALUE);
		} else {
		reply->writeInt32(setDataSource(source));
		}
		return NO_ERROR;
		} break;
		case GET_FRAME_AT_TIME: {

+14 −2

Original line number	Diff line number	Diff line
		@@ -444,6 +444,10 @@ status_t BnMediaPlayer::onTransact(
		}

		const char* url = data.readCString();
		if (httpService == NULL \|\| url == NULL) {
		reply->writeInt32(BAD_VALUE);
		return NO_ERROR;
		}
		KeyedVector<String8, String8> headers;
		int32_t numHeaders = data.readInt32();
		for (int i = 0; i < numHeaders; ++i) {
		@@ -467,14 +471,22 @@ status_t BnMediaPlayer::onTransact(
		CHECK_INTERFACE(IMediaPlayer, data, reply);
		sp<IStreamSource> source =
		interface_cast<IStreamSource>(data.readStrongBinder());
		if (source == NULL) {
		reply->writeInt32(BAD_VALUE);
		} else {
		reply->writeInt32(setDataSource(source));
		}
		return NO_ERROR;
		}
		case SET_DATA_SOURCE_CALLBACK: {
		CHECK_INTERFACE(IMediaPlayer, data, reply);
		sp<IDataSource> source =
		interface_cast<IDataSource>(data.readStrongBinder());
		if (source == NULL) {
		reply->writeInt32(BAD_VALUE);
		} else {
		reply->writeInt32(setDataSource(source));
		}
		return NO_ERROR;
		}
		case SET_VIDEO_SURFACETEXTURE: {

+4 −0

Original line number	Diff line number	Diff line
		@@ -220,6 +220,10 @@ status_t BnMediaPlayerService::onTransact(
		const String16 opPackageName = data.readString16();
		sp<IRemoteDisplayClient> client(
		interface_cast<IRemoteDisplayClient>(data.readStrongBinder()));
		if (client == NULL) {
		reply->writeStrongBinder(NULL);
		return NO_ERROR;
		}
		String8 iface(data.readString8());
		sp<IRemoteDisplay> display(listenForRemoteDisplay(opPackageName, client, iface));
		reply->writeStrongBinder(IInterface::asBinder(display));