commit 1003199cb8962688d7530ad802565671b4833299
author Mike Lockwood <lockwood@android.com> Mon Apr 25 12:56:21 2011 -0700
committer Mike Lockwood <lockwood@android.com> Mon Apr 25 13:36:11 2011 -0700
tree a12b62120e93b387182a7eec561dfdcf442510e2
parent 997354e4b4a9666cedd62282471e97822affced9

MTP: Fix file descriptor leak in file editing extensions

Change-Id: I6d0de5efe705d8060bbfd526c6880dc995a3aa30
Signed-off-by: Mike Lockwood <lockwood@android.com>

media/mtp/MtpServer.cpp

diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index ff4009c..b744b5b 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -270,12 +270,7 @@
 
 void MtpServer::addEditObject(MtpObjectHandle handle, MtpString& path,
         uint64_t size, MtpObjectFormat format, int fd) {
-    ObjectEdit*  edit = new ObjectEdit;
-    edit->handle = handle;
-    edit->path = path;
-    edit->size = size;
-    edit->format = format;
-    edit->fd = fd;
+    ObjectEdit*  edit = new ObjectEdit(handle, path, size, format, fd);
     mObjectEditList.add(edit);
 }
 
@@ -283,7 +278,7 @@
     int count = mObjectEditList.size();
     for (int i = 0; i < count; i++) {
         ObjectEdit* edit = mObjectEditList[i];
-        if (edit->handle == handle) return edit;
+        if (edit->mHandle == handle) return edit;
     }
     return NULL;
 }
@@ -292,7 +287,7 @@
     int count = mObjectEditList.size();
     for (int i = 0; i < count; i++) {
         ObjectEdit* edit = mObjectEditList[i];
-        if (edit->handle == handle) {
+        if (edit->mHandle == handle) {
             delete edit;
             mObjectEditList.removeAt(i);
             return;
@@ -302,7 +297,7 @@
 }
 
 void MtpServer::commitEdit(ObjectEdit* edit) {
-    mDatabase->endSendObject((const char *)edit->path, edit->handle, edit->format, true);
+    mDatabase->endSendObject((const char *)edit->mPath, edit->mHandle, edit->mFormat, true);
 }
 
 
@@ -681,7 +676,7 @@
         uint32_t size = info.mCompressedSize;
         ObjectEdit* edit = getEditObject(handle);
         if (edit)
-            size = (edit->size > 0xFFFFFFFFLL ? 0xFFFFFFFF : (uint32_t)edit->size);
+            size = (edit->mSize > 0xFFFFFFFFLL ? 0xFFFFFFFF : (uint32_t)edit->mSize);
         mData.putUInt32(size);
 
         mData.putUInt16(info.mThumbFormat);
@@ -1059,8 +1054,8 @@
     }
 
     // can't start writing past the end of the file
-    if (offset > edit->size) {
-        LOGD("writing past end of object, offset: %lld, edit->size: %lld", offset, edit->size);
+    if (offset > edit->mSize) {
+        LOGD("writing past end of object, offset: %lld, edit->mSize: %lld", offset, edit->mSize);
         return MTP_RESPONSE_GENERAL_ERROR;
     }
 
@@ -1071,10 +1066,10 @@
     // reset so we don't attempt to send this back
     mData.reset();
 
-    const char* filePath = (const char *)edit->path;
+    const char* filePath = (const char *)edit->mPath;
     LOGV("receiving partial %s %lld %ld\n", filePath, offset, length);
     mtp_file_range  mfr;
-    mfr.fd = edit->fd;
+    mfr.fd = edit->mFD;
     mfr.offset = offset;
     mfr.length = length;
 
@@ -1090,8 +1085,8 @@
     }
     mResponse.setParameter(1, length);
     uint64_t end = offset + length;
-    if (end > edit->size) {
-        edit->size = end;
+    if (end > edit->mSize) {
+        edit->mSize = end;
     }
     return MTP_RESPONSE_OK;
 }
@@ -1107,10 +1102,10 @@
     uint64_t offset = mRequest.getParameter(2);
     uint64_t offset2 = mRequest.getParameter(3);
     offset |= (offset2 << 32);
-    if (ftruncate(edit->fd, offset) != 0) {
+    if (ftruncate(edit->mFD, offset) != 0) {
         return MTP_RESPONSE_GENERAL_ERROR;
     } else {
-        edit->size = offset;
+        edit->mSize = offset;
         return MTP_RESPONSE_OK;
     }
 }