Merge "AAPT: Fix use-after-free error" into nyc-mr1-dev (1031069f) · Commits · e / os / android_frameworks_base

tools/aapt/Resource.cpp

+11 −6

Original line number	Diff line number	Diff line
		@@ -1033,7 +1033,6 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
		return NO_ERROR;
		}

		ResXMLTree tree;
		Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);
		if (asset == NULL) {
		fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
		@@ -1041,12 +1040,18 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
		}

		ssize_t result = NO_ERROR;

		// Create a new scope so that ResXMLTree is destroyed before we delete the memory over
		// which it iterates (asset).
		{
		ResXMLTree tree;
		if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
		fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");
		result = UNKNOWN_ERROR;
		} else {
		result = extractPlatformBuildVersion(tree, bundle);
		}
		}

		delete asset;
		return result;