libmedia: check NULL pointer at binder receiver side.
Change-Id: I464da96f3d6081dd8c3cc2fd977e2b96f5d477bb
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 7fb1acc..433cb02 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -261,7 +261,11 @@
CHECK_INTERFACE(ICrypto, data, reply);
const char *mime = data.readCString();
- reply->writeInt32(requiresSecureDecoderComponent(mime));
+ if (mime == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ } else {
+ reply->writeInt32(requiresSecureDecoderComponent(mime));
+ }
return OK;
}
@@ -282,6 +286,10 @@
size_t totalSize = data.readInt32();
sp<IMemory> sharedBuffer =
interface_cast<IMemory>(data.readStrongBinder());
+ if (sharedBuffer == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ return OK;
+ }
int32_t offset = data.readInt32();
int32_t numSubSamples = data.readInt32();
diff --git a/media/libmedia/IMediaCodecList.cpp b/media/libmedia/IMediaCodecList.cpp
index e2df104..737f50c 100644
--- a/media/libmedia/IMediaCodecList.cpp
+++ b/media/libmedia/IMediaCodecList.cpp
@@ -157,6 +157,10 @@
{
CHECK_INTERFACE(IMediaCodecList, data, reply);
const char *type = data.readCString();
+ if (type == NULL) {
+ reply->writeInt32(NAME_NOT_FOUND);
+ return NO_ERROR;
+ }
bool isEncoder = static_cast<bool>(data.readInt32());
size_t startIndex = static_cast<size_t>(data.readInt32());
ssize_t index = findCodecByType(type, isEncoder, startIndex);
@@ -172,6 +176,10 @@
{
CHECK_INTERFACE(IMediaCodecList, data, reply);
const char *name = data.readCString();
+ if (name == NULL) {
+ reply->writeInt32(NAME_NOT_FOUND);
+ return NO_ERROR;
+ }
ssize_t index = findCodecByName(name);
if (index > INT32_MAX || index < 0) {
index = NAME_NOT_FOUND;
diff --git a/media/libmedia/IMediaMetadataRetriever.cpp b/media/libmedia/IMediaMetadataRetriever.cpp
index dbf524e..0bee8d3 100644
--- a/media/libmedia/IMediaMetadataRetriever.cpp
+++ b/media/libmedia/IMediaMetadataRetriever.cpp
@@ -224,6 +224,11 @@
const char* srcUrl = data.readCString();
+ if (httpService == NULL || srcUrl == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ return NO_ERROR;
+ }
+
KeyedVector<String8, String8> headers;
size_t numHeaders = (size_t) data.readInt64();
for (size_t i = 0; i < numHeaders; ++i) {
@@ -250,7 +255,11 @@
CHECK_INTERFACE(IMediaMetadataRetriever, data, reply);
sp<IDataSource> source =
interface_cast<IDataSource>(data.readStrongBinder());
- reply->writeInt32(setDataSource(source));
+ if (source == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ } else {
+ reply->writeInt32(setDataSource(source));
+ }
return NO_ERROR;
} break;
case GET_FRAME_AT_TIME: {
diff --git a/media/libmedia/IMediaPlayer.cpp b/media/libmedia/IMediaPlayer.cpp
index 942aec3..c523629 100644
--- a/media/libmedia/IMediaPlayer.cpp
+++ b/media/libmedia/IMediaPlayer.cpp
@@ -444,6 +444,10 @@
}
const char* url = data.readCString();
+ if (httpService == NULL || url == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ return NO_ERROR;
+ }
KeyedVector<String8, String8> headers;
int32_t numHeaders = data.readInt32();
for (int i = 0; i < numHeaders; ++i) {
@@ -467,14 +471,22 @@
CHECK_INTERFACE(IMediaPlayer, data, reply);
sp<IStreamSource> source =
interface_cast<IStreamSource>(data.readStrongBinder());
- reply->writeInt32(setDataSource(source));
+ if (source == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ } else {
+ reply->writeInt32(setDataSource(source));
+ }
return NO_ERROR;
}
case SET_DATA_SOURCE_CALLBACK: {
CHECK_INTERFACE(IMediaPlayer, data, reply);
sp<IDataSource> source =
interface_cast<IDataSource>(data.readStrongBinder());
- reply->writeInt32(setDataSource(source));
+ if (source == NULL) {
+ reply->writeInt32(BAD_VALUE);
+ } else {
+ reply->writeInt32(setDataSource(source));
+ }
return NO_ERROR;
}
case SET_VIDEO_SURFACETEXTURE: {
diff --git a/media/libmedia/IMediaPlayerService.cpp b/media/libmedia/IMediaPlayerService.cpp
index 05f8670..afc94ab 100644
--- a/media/libmedia/IMediaPlayerService.cpp
+++ b/media/libmedia/IMediaPlayerService.cpp
@@ -220,6 +220,10 @@
const String16 opPackageName = data.readString16();
sp<IRemoteDisplayClient> client(
interface_cast<IRemoteDisplayClient>(data.readStrongBinder()));
+ if (client == NULL) {
+ reply->writeStrongBinder(NULL);
+ return NO_ERROR;
+ }
String8 iface(data.readString8());
sp<IRemoteDisplay> display(listenForRemoteDisplay(opPackageName, client, iface));
reply->writeStrongBinder(IInterface::asBinder(display));
diff --git a/media/libmedia/IResourceManagerService.cpp b/media/libmedia/IResourceManagerService.cpp
index 4598686..6cb4440 100644
--- a/media/libmedia/IResourceManagerService.cpp
+++ b/media/libmedia/IResourceManagerService.cpp
@@ -132,6 +132,9 @@
int64_t clientId = data.readInt64();
sp<IResourceManagerClient> client(
interface_cast<IResourceManagerClient>(data.readStrongBinder()));
+ if (client == NULL) {
+ return NO_ERROR;
+ }
Vector<MediaResource> resources;
readFromParcel(data, &resources);
addResource(pid, clientId, client, resources);
diff --git a/media/libmedia/IStreamSource.cpp b/media/libmedia/IStreamSource.cpp
index 840e453..8c0905c 100644
--- a/media/libmedia/IStreamSource.cpp
+++ b/media/libmedia/IStreamSource.cpp
@@ -111,7 +111,11 @@
sp<IMemory> mem =
interface_cast<IMemory>(data.readStrongBinder());
- buffers.push(mem);
+ if (mem != NULL) {
+ buffers.push(mem);
+ } else if (data.dataAvail() == 0) {
+ break;
+ }
}
setBuffers(buffers);
break;
diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index a416381..dda0a57 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -1246,7 +1246,10 @@
if (client->mAudioOutput != NULL)
client->mAudioOutput->switchToNextOutput();
client->mNextClient->start();
- client->mNextClient->mClient->notify(MEDIA_INFO, MEDIA_INFO_STARTED_AS_NEXT, 0, obj);
+ if (client->mNextClient->mClient != NULL) {
+ client->mNextClient->mClient->notify(
+ MEDIA_INFO, MEDIA_INFO_STARTED_AS_NEXT, 0, obj);
+ }
}
}