Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d9f1ddde authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Fix for heap buffer overflow issue flagged by fuzzer test." into... 

Merge "Fix for heap buffer overflow issue flagged by fuzzer test." into udc-dev am: 67877620 am: c3f5e16b

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/24303963



Change-Id: I3619597dc2b350740832c94cc0fdd52de7232704
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents f2970a64 c3f5e16b

media/mtp/MtpPacket.cpp

+31 −9
Original line number Diff line number Diff line
@@ -92,25 +92,47 @@ void MtpPacket::copyFrom(const MtpPacket& src) { 
}



uint16_t MtpPacket::getUInt16(int offset) const {

    if ((unsigned long)(offset+2) <= mBufferSize) {

        return ((uint16_t)mBuffer[offset + 1] << 8) | (uint16_t)mBuffer[offset];

    }

    else {

        ALOGE("offset for buffer read is greater than buffer size!");

        abort();

    }

}



uint32_t MtpPacket::getUInt32(int offset) const {

    if ((unsigned long)(offset+4) <= mBufferSize) {

        return ((uint32_t)mBuffer[offset + 3] << 24) | ((uint32_t)mBuffer[offset + 2] << 16) |

               ((uint32_t)mBuffer[offset + 1] << 8)  | (uint32_t)mBuffer[offset];

    }

    else {

        ALOGE("offset for buffer read is greater than buffer size!");

        abort();

    }

}



void MtpPacket::putUInt16(int offset, uint16_t value) {

    if ((unsigned long)(offset+2) <= mBufferSize) {

        mBuffer[offset++] = (uint8_t)(value & 0xFF);

        mBuffer[offset++] = (uint8_t)((value >> 8) & 0xFF);

    }

    else {

        ALOGE("offset for buffer write is greater than buffer size!");

    }

}



void MtpPacket::putUInt32(int offset, uint32_t value) {

    if ((unsigned long)(offset+4) <= mBufferSize) {

        mBuffer[offset++] = (uint8_t)(value & 0xFF);

        mBuffer[offset++] = (uint8_t)((value >> 8) & 0xFF);

        mBuffer[offset++] = (uint8_t)((value >> 16) & 0xFF);

        mBuffer[offset++] = (uint8_t)((value >> 24) & 0xFF);

    }

    else {

        ALOGE("offset for buffer write is greater than buffer size!");

    }

}



uint16_t MtpPacket::getContainerCode() const {

    return getUInt16(MTP_CONTAINER_CODE_OFFSET);