Add some sanity checks (59cea261) · Commits · e / os / android_frameworks_av

media/libmedia/IMediaHTTPConnection.cpp

+11 −3

Original line number	Diff line number	Diff line
		@@ -24,6 +24,7 @@
		#include <binder/Parcel.h>
		#include <utils/String8.h>
		#include <media/stagefright/foundation/ADebug.h>
		#include <media/stagefright/MediaErrors.h>

		namespace android {

		@@ -106,12 +107,19 @@ struct BpMediaHTTPConnection : public BpInterface<IMediaHTTPConnection> {
		return UNKNOWN_ERROR;
		}

		int32_t len = reply.readInt32();
		size_t len = reply.readInt32();

		if (len > 0) {
		memcpy(buffer, mMemory->pointer(), len);
		if (len > size) {
		ALOGE("requested %zu, got %zu", size, len);
		return ERROR_OUT_OF_RANGE;
		}
		if (len > mMemory->size()) {
		ALOGE("got %zu, but memory has %zu", len, mMemory->size());
		return ERROR_OUT_OF_RANGE;
		}

		memcpy(buffer, mMemory->pointer(), len);

		return len;
		}