AAPT: Fix use-after-free error am: 193ed74c2d (9e8da4a4) · Commits · e / os / android_frameworks_base

tools/aapt/Resource.cpp

+11 −6

Original line number	Original line	Diff line number	Diff line
	@@ -1033,7 +1033,6 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
	return NO_ERROR;		return NO_ERROR;
	}		}

	ResXMLTree tree;
	Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);		Asset* asset = assets.openNonAsset(cookie, "AndroidManifest.xml", Asset::ACCESS_STREAMING);
	if (asset == NULL) {		if (asset == NULL) {
	fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");		fprintf(stderr, "ERROR: Platform AndroidManifest.xml not found\n");
	@@ -1041,12 +1040,18 @@ static ssize_t extractPlatformBuildVersion(AssetManager& assets, Bundle* bundle)
	}		}

	ssize_t result = NO_ERROR;		ssize_t result = NO_ERROR;

			// Create a new scope so that ResXMLTree is destroyed before we delete the memory over
			// which it iterates (asset).
			{
			ResXMLTree tree;
	if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {		if (tree.setTo(asset->getBuffer(true), asset->getLength()) != NO_ERROR) {
	fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");		fprintf(stderr, "ERROR: Platform AndroidManifest.xml is corrupt\n");
	result = UNKNOWN_ERROR;		result = UNKNOWN_ERROR;
	} else {		} else {
	result = extractPlatformBuildVersion(tree, bundle);		result = extractPlatformBuildVersion(tree, bundle);
	}		}
			}

	delete asset;		delete asset;
	return result;		return result;