Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 365e03e4 authored by Mike Lockwood's avatar Mike Lockwood
Browse files

MTP: Improve argument checking in SendObjectInfo 



In particular, make sure the parent is a folder and make sure file
does not already exist.

Change-Id: Ifa870faba3285f03a92025d9e82f93fed78a761c
Signed-off-by: default avatarMike Lockwood <lockwood@android.com>
parent 7f889328

media/java/android/media/MtpDatabase.java

+8 −5
Original line number Diff line number Diff line
@@ -76,10 +76,11 @@ public class MtpDatabase { 
            Files.FileColumns._ID, // 0

            Files.FileColumns.DATA, // 1

    };

    private static final String[] PATH_SIZE_PROJECTION = new String[] {

    private static final String[] PATH_SIZE_FORMAT_PROJECTION = new String[] {

            Files.FileColumns._ID, // 0

            Files.FileColumns.DATA, // 1

            Files.FileColumns.SIZE, // 2

            Files.FileColumns.FORMAT, // 3

    };

    private static final String[] OBJECT_INFO_PROJECTION = new String[] {

            Files.FileColumns._ID, // 0
@@ -670,24 +671,26 @@ public class MtpDatabase { 
        return false;

    }



    private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLength) {

    private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLengthFormat) {

        Log.d(TAG, "getObjectFilePath: " + handle);

        if (handle == 0) {

            // special case root directory

            mMediaStoragePath.getChars(0, mMediaStoragePath.length(), outFilePath, 0);

            outFilePath[mMediaStoragePath.length()] = 0;

            outFileLength[0] = 0;

            outFileLengthFormat[0] = 0;

            outFileLengthFormat[1] = MtpConstants.FORMAT_ASSOCIATION;

            return MtpConstants.RESPONSE_OK;

        }

        Cursor c = null;

        try {

            c = mMediaProvider.query(mObjectsUri, PATH_SIZE_PROJECTION,

            c = mMediaProvider.query(mObjectsUri, PATH_SIZE_FORMAT_PROJECTION,

                            ID_WHERE, new String[] {  Integer.toString(handle) }, null);

            if (c != null && c.moveToNext()) {

                String path = externalToMediaPath(c.getString(1));

                path.getChars(0, path.length(), outFilePath, 0);

                outFilePath[path.length()] = 0;

                outFileLength[0] = c.getLong(2);

                outFileLengthFormat[0] = c.getLong(2);

                outFileLengthFormat[1] = c.getLong(3);

                return MtpConstants.RESPONSE_OK;

            } else {

                return MtpConstants.RESPONSE_INVALID_OBJECT_HANDLE;

media/jni/android_media_MtpDatabase.cpp

+9 −6
Original line number Diff line number Diff line
@@ -142,8 +142,9 @@ public: 
                                            MtpDataPacket& packet);



    virtual MtpResponseCode         getObjectFilePath(MtpObjectHandle handle,

                                            MtpString& filePath,

                                            int64_t& fileLength);

                                            MtpString& outFilePath,

                                            int64_t& outFileLength,

                                            MtpObjectFormat& outFormat);

    virtual MtpResponseCode         deleteFile(MtpObjectHandle handle);



    bool                            getObjectPropertyInfo(MtpObjectProperty property, int& type);
@@ -801,8 +802,9 @@ MtpResponseCode MyMtpDatabase::getObjectInfo(MtpObjectHandle handle, 
}



MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle,

                                            MtpString& filePath,

                                            int64_t& fileLength) {

                                            MtpString& outFilePath,

                                            int64_t& outFileLength,

                                            MtpObjectFormat& outFormat) {

    JNIEnv* env = AndroidRuntime::getJNIEnv();

    jint result = env->CallIntMethod(mDatabase, method_getObjectFilePath,

                (jint)handle, mStringBuffer, mLongBuffer);
@@ -812,11 +814,12 @@ MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle, 
    }



    jchar* str = env->GetCharArrayElements(mStringBuffer, 0);

    filePath.setTo(str, strlen16(str));

    outFilePath.setTo(str, strlen16(str));

    env->ReleaseCharArrayElements(mStringBuffer, str, 0);



    jlong* longValues = env->GetLongArrayElements(mLongBuffer, 0);

    fileLength = longValues[0];

    outFileLength = longValues[0];

    outFormat = longValues[1];

    env->ReleaseLongArrayElements(mLongBuffer, longValues, 0);

    

    checkAndClearExceptionFromCallback(env, __FUNCTION__);

media/mtp/MtpDatabase.h

+3 −2
Original line number Diff line number Diff line
@@ -85,8 +85,9 @@ public: 
                                            MtpDataPacket& packet) = 0;



    virtual MtpResponseCode         getObjectFilePath(MtpObjectHandle handle,

                                            MtpString& filePath,

                                            int64_t& fileLength) = 0;

                                            MtpString& outFilePath,

                                            int64_t& outFileLength,

                                            MtpObjectFormat& outFormat) = 0;



    virtual MtpResponseCode         deleteFile(MtpObjectHandle handle) = 0;

media/mtp/MtpProperty.cpp

+1 −0
Original line number Diff line number Diff line
@@ -343,6 +343,7 @@ void MtpProperty::print() { 
            print(mMaximumValue, buffer);

            buffer += ", ";

            print(mStepSize, buffer);

            buffer += ")";

            LOGI("%s", (const char *)buffer);

            break;

        case kFormEnum:

media/mtp/MtpServer.cpp

+17 −6
Original line number Diff line number Diff line
@@ -112,6 +112,8 @@ void MtpServer::addStorage(const char* filePath) { 
}



MtpStorage* MtpServer::getStorage(MtpStorageID id) {

    if (id == 0)

        return mStorages[0];

    for (int i = 0; i < mStorages.size(); i++) {

        MtpStorage* storage = mStorages[i];

        if (storage->getStorageID() == id)
@@ -557,7 +559,8 @@ MtpResponseCode MtpServer::doGetObject() { 
    MtpObjectHandle handle = mRequest.getParameter(1);

    MtpString pathBuf;

    int64_t fileLength;

    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);

    MtpObjectFormat format;

    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);

    if (result != MTP_RESPONSE_OK)

        return result;
@@ -593,7 +596,8 @@ MtpResponseCode MtpServer::doGetPartialObject() { 
    uint32_t length = mRequest.getParameter(3);

    MtpString pathBuf;

    int64_t fileLength;

    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);

    MtpObjectFormat format;

    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);

    if (result != MTP_RESPONSE_OK)

        return result;

    if (offset + length > fileLength)
@@ -639,10 +643,13 @@ MtpResponseCode MtpServer::doSendObjectInfo() { 
        path = storage->getPath();

        parent = 0;

    } else {

        int64_t dummy;

        int result = mDatabase->getObjectFilePath(parent, path, dummy);

        int64_t length;

        MtpObjectFormat format;

        int result = mDatabase->getObjectFilePath(parent, path, length, format);

        if (result != MTP_RESPONSE_OK)

            return result;

        if (format != MTP_FORMAT_ASSOCIATION)

            return MTP_RESPONSE_INVALID_PARENT_OBJECT;

    }



    // read only the fields we need
@@ -676,6 +683,10 @@ MtpResponseCode MtpServer::doSendObjectInfo() { 
        path += "/";

    path += (const char *)name;



    // file should not already exist

    if (access(path, R_OK) == 0)

        return MTP_RESPONSE_GENERAL_ERROR;



    MtpObjectHandle handle = mDatabase->beginSendObject((const char*)path,

            format, parent, storageID, mSendObjectFileSize, modifiedTime);

    if (handle == kInvalidObjectHandle) {
@@ -835,7 +846,7 @@ MtpResponseCode MtpServer::doDeleteObject() { 


    MtpString filePath;

    int64_t fileLength;

    int result = mDatabase->getObjectFilePath(handle, filePath, fileLength);

    int result = mDatabase->getObjectFilePath(handle, filePath, fileLength, format);

    if (result == MTP_RESPONSE_OK) {

        LOGV("deleting %s", (const char *)filePath);

        deletePath((const char *)filePath);