Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77b6aaf6 authored by Glenn Kasten's avatar Glenn Kasten
Browse files

Fix bug in JetPlayer::loadFromFile 

A long pathname would corrupt the heap due to incorrect use of strncpy.

Also was using hard-coded constant 256 instead of PATH_MAX.

Change-Id: Iba382bbb38624fbc41fec91449f9814f77d4ac0d
parent 38e90751

include/media/JetPlayer.h

+1 −1
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ private: 
    S_JET_STATUS        mJetStatus;

    S_JET_STATUS        mPreviousJetStatus;



    char                mJetFilePath[256];

    char                mJetFilePath[PATH_MAX];



    class JetPlayerThread : public Thread {

    public:

media/libmedia/JetPlayer.cpp

+2 −2
Original line number Diff line number Diff line
@@ -338,8 +338,8 @@ int JetPlayer::loadFromFile(const char* path) 
    Mutex::Autolock lock(mMutex);



    mEasJetFileLoc = (EAS_FILE_LOCATOR) malloc(sizeof(EAS_FILE));

    memset(mJetFilePath, 0, 256);

    strncpy(mJetFilePath, path, strlen(path));

    strncpy(mJetFilePath, path, sizeof(mJetFilePath));

    mJetFilePath[sizeof(mJetFilePath) - 1] = '\0';

    mEasJetFileLoc->path = mJetFilePath;



    mEasJetFileLoc->fd = 0;