Merge "MTP: Improve argument checking in SendObjectInfo" (51f56cbd) · Commits · e / os / android_frameworks_base

media/java/android/media/MtpDatabase.java

+8 −5

Original line number	Diff line number	Diff line
		@@ -76,10 +76,11 @@ public class MtpDatabase {
		Files.FileColumns._ID, // 0
		Files.FileColumns.DATA, // 1
		};
		private static final String[] PATH_SIZE_PROJECTION = new String[] {
		private static final String[] PATH_SIZE_FORMAT_PROJECTION = new String[] {
		Files.FileColumns._ID, // 0
		Files.FileColumns.DATA, // 1
		Files.FileColumns.SIZE, // 2
		Files.FileColumns.FORMAT, // 3
		};
		private static final String[] OBJECT_INFO_PROJECTION = new String[] {
		Files.FileColumns._ID, // 0
		@@ -670,24 +671,26 @@ public class MtpDatabase {
		return false;
		}

		private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLength) {
		private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLengthFormat) {
		Log.d(TAG, "getObjectFilePath: " + handle);
		if (handle == 0) {
		// special case root directory
		mMediaStoragePath.getChars(0, mMediaStoragePath.length(), outFilePath, 0);
		outFilePath[mMediaStoragePath.length()] = 0;
		outFileLength[0] = 0;
		outFileLengthFormat[0] = 0;
		outFileLengthFormat[1] = MtpConstants.FORMAT_ASSOCIATION;
		return MtpConstants.RESPONSE_OK;
		}
		Cursor c = null;
		try {
		c = mMediaProvider.query(mObjectsUri, PATH_SIZE_PROJECTION,
		c = mMediaProvider.query(mObjectsUri, PATH_SIZE_FORMAT_PROJECTION,
		ID_WHERE, new String[] { Integer.toString(handle) }, null);
		if (c != null && c.moveToNext()) {
		String path = externalToMediaPath(c.getString(1));
		path.getChars(0, path.length(), outFilePath, 0);
		outFilePath[path.length()] = 0;
		outFileLength[0] = c.getLong(2);
		outFileLengthFormat[0] = c.getLong(2);
		outFileLengthFormat[1] = c.getLong(3);
		return MtpConstants.RESPONSE_OK;
		} else {
		return MtpConstants.RESPONSE_INVALID_OBJECT_HANDLE;

media/jni/android_media_MtpDatabase.cpp

+9 −6

Original line number	Diff line number	Diff line
		@@ -142,8 +142,9 @@ public:
		MtpDataPacket& packet);

		virtual MtpResponseCode getObjectFilePath(MtpObjectHandle handle,
		MtpString& filePath,
		int64_t& fileLength);
		MtpString& outFilePath,
		int64_t& outFileLength,
		MtpObjectFormat& outFormat);
		virtual MtpResponseCode deleteFile(MtpObjectHandle handle);

		bool getObjectPropertyInfo(MtpObjectProperty property, int& type);
		@@ -801,8 +802,9 @@ MtpResponseCode MyMtpDatabase::getObjectInfo(MtpObjectHandle handle,
		}

		MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle,
		MtpString& filePath,
		int64_t& fileLength) {
		MtpString& outFilePath,
		int64_t& outFileLength,
		MtpObjectFormat& outFormat) {
		JNIEnv* env = AndroidRuntime::getJNIEnv();
		jint result = env->CallIntMethod(mDatabase, method_getObjectFilePath,
		(jint)handle, mStringBuffer, mLongBuffer);
		@@ -812,11 +814,12 @@ MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle,
		}

		jchar* str = env->GetCharArrayElements(mStringBuffer, 0);
		filePath.setTo(str, strlen16(str));
		outFilePath.setTo(str, strlen16(str));
		env->ReleaseCharArrayElements(mStringBuffer, str, 0);

		jlong* longValues = env->GetLongArrayElements(mLongBuffer, 0);
		fileLength = longValues[0];
		outFileLength = longValues[0];
		outFormat = longValues[1];
		env->ReleaseLongArrayElements(mLongBuffer, longValues, 0);

		checkAndClearExceptionFromCallback(env, __FUNCTION__);

media/mtp/MtpDatabase.h

+3 −2

Original line number	Diff line number	Diff line
		@@ -85,8 +85,9 @@ public:
		MtpDataPacket& packet) = 0;

		virtual MtpResponseCode getObjectFilePath(MtpObjectHandle handle,
		MtpString& filePath,
		int64_t& fileLength) = 0;
		MtpString& outFilePath,
		int64_t& outFileLength,
		MtpObjectFormat& outFormat) = 0;

		virtual MtpResponseCode deleteFile(MtpObjectHandle handle) = 0;

media/mtp/MtpProperty.cpp

+1 −0

Original line number	Diff line number	Diff line
		@@ -343,6 +343,7 @@ void MtpProperty::print() {
		print(mMaximumValue, buffer);
		buffer += ", ";
		print(mStepSize, buffer);
		buffer += ")";
		LOGI("%s", (const char *)buffer);
		break;
		case kFormEnum:

media/mtp/MtpServer.cpp

+17 −6

Original line number	Diff line number	Diff line
		@@ -112,6 +112,8 @@ void MtpServer::addStorage(const char* filePath) {
		}

		MtpStorage* MtpServer::getStorage(MtpStorageID id) {
		if (id == 0)
		return mStorages[0];
		for (int i = 0; i < mStorages.size(); i++) {
		MtpStorage* storage = mStorages[i];
		if (storage->getStorageID() == id)
		@@ -557,7 +559,8 @@ MtpResponseCode MtpServer::doGetObject() {
		MtpObjectHandle handle = mRequest.getParameter(1);
		MtpString pathBuf;
		int64_t fileLength;
		int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);
		MtpObjectFormat format;
		int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);
		if (result != MTP_RESPONSE_OK)
		return result;

		@@ -593,7 +596,8 @@ MtpResponseCode MtpServer::doGetPartialObject() {
		uint32_t length = mRequest.getParameter(3);
		MtpString pathBuf;
		int64_t fileLength;
		int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);
		MtpObjectFormat format;
		int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);
		if (result != MTP_RESPONSE_OK)
		return result;
		if (offset + length > fileLength)
		@@ -639,10 +643,13 @@ MtpResponseCode MtpServer::doSendObjectInfo() {
		path = storage->getPath();
		parent = 0;
		} else {
		int64_t dummy;
		int result = mDatabase->getObjectFilePath(parent, path, dummy);
		int64_t length;
		MtpObjectFormat format;
		int result = mDatabase->getObjectFilePath(parent, path, length, format);
		if (result != MTP_RESPONSE_OK)
		return result;
		if (format != MTP_FORMAT_ASSOCIATION)
		return MTP_RESPONSE_INVALID_PARENT_OBJECT;
		}

		// read only the fields we need
		@@ -676,6 +683,10 @@ MtpResponseCode MtpServer::doSendObjectInfo() {
		path += "/";
		path += (const char *)name;

		// file should not already exist
		if (access(path, R_OK) == 0)
		return MTP_RESPONSE_GENERAL_ERROR;

		MtpObjectHandle handle = mDatabase->beginSendObject((const char*)path,
		format, parent, storageID, mSendObjectFileSize, modifiedTime);
		if (handle == kInvalidObjectHandle) {
		@@ -835,7 +846,7 @@ MtpResponseCode MtpServer::doDeleteObject() {

		MtpString filePath;
		int64_t fileLength;
		int result = mDatabase->getObjectFilePath(handle, filePath, fileLength);
		int result = mDatabase->getObjectFilePath(handle, filePath, fileLength, format);
		if (result == MTP_RESPONSE_OK) {
		LOGV("deleting %s", (const char *)filePath);
		deletePath((const char *)filePath);