commit 688cec6e7adb88f3a121ab94d5aaa9ecd9a0d312
author Ray Essick <essick@google.com> Thu Apr 21 21:28:05 2022 -0700
committer Cherrypicker Worker <android-build-cherrypicker-worker@google.com> Sat Apr 23 04:41:01 2022 +0000
tree b216c05991f2dbd3a454c555930588c357493453
parent c1e2647495d6b3806afa3f83d8eadcb5b4b77d20

Avoid null pointer dereference

on failed call to convertMetaDataToMessage(), return NULL instead
of assigning a null and proceeding with routine.

Bug: 229522006
Test: re-run clusterfuzz case from bug
Change-Id: I9bf705a4f543011cc35505b34dbd664f1f40f80f
(cherry picked from commit 7c9c49ee3edc9e618a42300bec093839fa8a69e6)
Merged-In: I9bf705a4f543011cc35505b34dbd664f1f40f80f

media/libmediaplayerservice/StagefrightMetadataRetriever.cpp

diff --git a/media/libmediaplayerservice/StagefrightMetadataRetriever.cpp b/media/libmediaplayerservice/StagefrightMetadataRetriever.cpp
index 55b1ed7..b3f7f25 100644
--- a/media/libmediaplayerservice/StagefrightMetadataRetriever.cpp
+++ b/media/libmediaplayerservice/StagefrightMetadataRetriever.cpp
@@ -216,7 +216,8 @@
     sp<AMessage> format = new AMessage;
     status_t err = convertMetaDataToMessage(trackMeta, &format);
     if (err != OK) {
-        format = NULL;
+        ALOGE("getImageInternal: convertMetaDataToMessage() failed, unable to extract image");
+        return NULL;
     }
 
     uint32_t bitDepth = 8;
@@ -400,7 +401,8 @@
     sp<AMessage> format = new AMessage;
     status_t err = convertMetaDataToMessage(trackMeta, &format);
     if (err != OK) {
-        format = NULL;
+        ALOGE("getFrameInternal: convertMetaDataToMessage() failed, unable to extract frame");
+        return NULL;
     }
 
     Vector<AString> matchingCodecs;