MTP: Make sure buffer is big enough before reading the data packet



Fixes buffer overflow when transferring large playlists.

Change-Id: I1b7feaf9e56d849e5b6609f0f68a6aa5a3ae1ea8
Signed-off-by: Mike Lockwood <lockwood@android.com>

parent c97e6f9f

media/mtp/MtpDataPacket.cpp

+1 −0

Original line number	Diff line number	Diff line
		@@ -351,6 +351,7 @@ int MtpDataPacket::read(int fd) {
		return -1;
		// then the following data
		int total = MtpPacket::getUInt32(MTP_CONTAINER_LENGTH_OFFSET);
		allocate(total);
		int remaining = total - MTP_CONTAINER_HEADER_SIZE;
		ret = ::read(fd, &mBuffer[0] + MTP_CONTAINER_HEADER_SIZE, remaining);
		if (ret != remaining)