Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c9fdf67 authored by Ray Essick's avatar Ray Essick
Browse files

Better parcel parsing in MediaMetadataRetriver 

parcel parsing during SET_DATA_SOURCE_URL pulled a count and
blindly assumed there was that much data. Check that we successfully
get data from the parcel, complaining if not.

Also cleaned up a 32/64 bit inconsistency in how much data was put into
the parcel.

Bug: 132274514
Test: poc
Change-Id: I4d2c398906176b383426e96ba91f49547d327843
parent a5175b7a

media/libmedia/IMediaMetadataRetriever.cpp

+16 −5
Original line number Original line Diff line number Diff line
@@ -109,7 +109,7 @@ public: 
            data.writeInt32(0);

            data.writeInt32(0);

        } else {

        } else {

            // serialize the headers

            // serialize the headers

            data.writeInt64(headers->size());

            data.writeInt32(headers->size());

            for (size_t i = 0; i < headers->size(); ++i) {

            for (size_t i = 0; i < headers->size(); ++i) {

                data.writeString8(headers->keyAt(i));

                data.writeString8(headers->keyAt(i));

                data.writeString8(headers->valueAt(i));

                data.writeString8(headers->valueAt(i));
@@ -318,11 +318,22 @@ status_t BnMediaMetadataRetriever::onTransact( 
            }

            }





            KeyedVector<String8, String8> headers;

            KeyedVector<String8, String8> headers;

            size_t numHeaders = (size_t) data.readInt64();

            size_t numHeaders = (size_t) data.readInt32();

            for (size_t i = 0; i < numHeaders; ++i) {

            for (size_t i = 0; i < numHeaders; ++i) {

                String8 key = data.readString8();

                String8 key;

                String8 value = data.readString8();

                String8 value;

                headers.add(key, value);

                status_t status;

                status = data.readString8(&key);

                if (status != OK) {

                    return status;

                }

                status = data.readString8(&value);

                if (status != OK) {

                    return status;

                }

                if (headers.add(key, value) < 0) {

                    return UNKNOWN_ERROR;

                }

            }

            }





            reply->writeInt32(

            reply->writeInt32(