Add some sanity checks (636050c0) · Commits · e / os / android_frameworks_av

media/libmedia/IMediaHTTPConnection.cpp

+11 −3

Original line number	Original line	Diff line number	Diff line
	@@ -24,6 +24,7 @@
	#include <binder/Parcel.h>		#include <binder/Parcel.h>
	#include <utils/String8.h>		#include <utils/String8.h>
	#include <media/stagefright/foundation/ADebug.h>		#include <media/stagefright/foundation/ADebug.h>
			#include <media/stagefright/MediaErrors.h>

	namespace android {		namespace android {

	@@ -106,12 +107,19 @@ struct BpMediaHTTPConnection : public BpInterface<IMediaHTTPConnection> {
	return UNKNOWN_ERROR;		return UNKNOWN_ERROR;
	}		}

	int32_t len = reply.readInt32();		size_t len = reply.readInt32();

	if (len > 0) {		if (len > size) {
	memcpy(buffer, mMemory->pointer(), len);		ALOGE("requested %zu, got %zu", size, len);
			return ERROR_OUT_OF_RANGE;
			}
			if (len > mMemory->size()) {
			ALOGE("got %zu, but memory has %zu", len, mMemory->size());
			return ERROR_OUT_OF_RANGE;
	}		}

			memcpy(buffer, mMemory->pointer(), len);

	return len;		return len;
	}		}