Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit affa374b authored by James Dong's avatar James Dong Committed by Android Git Automerger
Browse files

am fb910e8f: Merge "Fixed a buffer overflow issue" into jb-dev

* commit 'fb910e8f':
  Fixed a buffer overflow issue
parents 887568c4 fb910e8f
Loading
Loading
Loading
Loading
+8 −3
Original line number Diff line number Diff line
@@ -2623,16 +2623,21 @@ videoEditor_init(
            M4OSA_Char* tmpString =
                (M4OSA_Char *)videoEditJava_getString(&initialized, pEnv, tempPath,
                NULL, M4OSA_NULL);
            M4OSA_UInt32 length = strlen((const char *)tmpString);
            // Malloc additional 2 bytes for beginning and tail separator.
            M4OSA_UInt32 pathLength = length + 2;

            pContext->initParams.pTempPath = (M4OSA_Char *)
                 M4OSA_32bitAlignedMalloc(strlen((const char *)tmpString) + 1, 0x0,
                                                 (M4OSA_Char *)"tempPath");
                 M4OSA_32bitAlignedMalloc(pathLength, 0x0, (M4OSA_Char *)"tempPath");

            //initialize the first char. so that strcat works.
            M4OSA_Char *ptmpChar = (M4OSA_Char*)pContext->initParams.pTempPath;
            ptmpChar[0] = 0x00;
            strncat((char *)pContext->initParams.pTempPath, (const char *)tmpString,
                (size_t)strlen((const char *)tmpString));
                length);
            strncat((char *)pContext->initParams.pTempPath, (const char *)"/", (size_t)1);
            free(tmpString);
            tmpString = NULL;
            pContext->mIsUpdateOverlay = false;
            pContext->mOverlayFileName = NULL;
            pContext->decoders = NULL;