Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b20688e7 authored by Andy Hung's avatar Andy Hung
Browse files

Check for non-negative fd before close, dup, lseek, or read.

Bug: 24896328
Change-Id: Idd8da8cf202f51f42d0a81421a91768ec3d5f025
parent 6411cb68
Loading
Loading
Loading
Loading
+8 −2
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ MidiIoWrapper::MidiIoWrapper(const char *path) {

MidiIoWrapper::MidiIoWrapper(int fd, off64_t offset, int64_t size) {
    ALOGV("MidiIoWrapper(fd=%d)", fd);
    mFd = dup(fd);
    mFd = fd < 0 ? -1 : dup(fd);
    mBase = offset;
    mLength = size;
}
@@ -61,8 +61,10 @@ MidiIoWrapper::MidiIoWrapper(const sp<DataSource> &source) {

MidiIoWrapper::~MidiIoWrapper() {
    ALOGV("~MidiIoWrapper");
    if (mFd >= 0) {
        close(mFd);
    }
}

int MidiIoWrapper::readAt(void *buffer, int offset, int size) {
    ALOGV("readAt(%p, %d, %d)", buffer, offset, size);
@@ -70,6 +72,10 @@ int MidiIoWrapper::readAt(void *buffer, int offset, int size) {
    if (mDataSource != NULL) {
        return mDataSource->readAt(offset, buffer, size);
    }
    if (mFd < 0) {
        errno = EBADF;
        return -1; // as per failed read.
    }
    lseek(mFd, mBase + offset, SEEK_SET);
    if (offset + size > mLength) {
        size = mLength - offset;