Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d72b2aa8 authored by Sangkyu Lee's avatar Sangkyu Lee
Browse files

Avoid invalid memory access when using extractMetadata() 



BpMediaMetadataRetriever::extractMetadata() returns a string
which is returned by readCString() function of the reply parcel object.
However, the parcel object is destroyed at the end of the
extractMetadata() function, and so the returned pointer is invalid.
This patch fixes this problem by storing the metadata string value.

Change-Id: I2a2ccba78246175b2845a237679d6cebe881e83b
Signed-off-by: default avatarSangkyu Lee <sk82.lee@lge.com>
parent 2cd9cc25

media/libmedia/IMediaMetadataRetriever.cpp

+16 −1
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <binder/Parcel.h>

#include <media/IMediaMetadataRetriever.h>

#include <utils/String8.h>

#include <utils/KeyedVector.h>



// The binder is supposed to propagate the scheduler group across

// the binder interface so that remote calls are executed with
@@ -161,8 +162,22 @@ public: 
        if (ret != NO_ERROR) {

            return NULL;

        }

        return reply.readCString();

        const char* str = reply.readCString();

        if (str != NULL) {

            String8 value(str);

            if (mMetadata.indexOfKey(keyCode) < 0) {

                mMetadata.add(keyCode, value);

            } else {

                mMetadata.replaceValueFor(keyCode, value);

            }

            return mMetadata.valueFor(keyCode).string();

        } else {

            return NULL;

        }

    }



private:

    KeyedVector<int, String8> mMetadata;

};



IMPLEMENT_META_INTERFACE(MediaMetadataRetriever, "android.media.IMediaMetadataRetriever");