commit b03b527afdd20b351b57b71ab2fbff5284435d81
author Daichi Hirono <hirono@google.com> Wed Jan 18 22:51:52 2017 +0000
committer android-build-merger <android-build-merger@google.com> Wed Jan 18 22:51:52 2017 +0000
tree e533fa52decbde07c0dd54e2fc02fada3d908d99
parent 9b1e2217e291cfd981378bc6273c705bb371b35c
parent 5c66471ad288640a89188f765fef5b41b4d3daf5

Stop sending object handle with sendObject request.
am: 5c66471ad2

Change-Id: I1581a4d9683fffe53549ab9b368a4bbf1ae60d40

media/mtp/MtpDevice.cpp

diff --git a/media/mtp/MtpDevice.cpp b/media/mtp/MtpDevice.cpp
index bd89a51..7301193 100644
--- a/media/mtp/MtpDevice.cpp
+++ b/media/mtp/MtpDevice.cpp
@@ -220,7 +220,9 @@
         mTransactionID(0),
         mReceivedResponse(false),
         mProcessingEvent(false),
-        mCurrentEventHandle(0)
+        mCurrentEventHandle(0),
+        mLastSendObjectInfoTransactionID(0),
+        mLastSendObjectInfoObjectHandle(0)
 {
     mRequestIn1 = usb_request_new(device, ep_in);
     mRequestIn2 = usb_request_new(device, ep_in);
@@ -490,6 +492,8 @@
    if (sendRequest(MTP_OPERATION_SEND_OBJECT_INFO) && sendData()) {
         MtpResponseCode ret = readResponse();
         if (ret == MTP_RESPONSE_OK) {
+            mLastSendObjectInfoTransactionID = mRequest.getTransactionID();
+            mLastSendObjectInfoObjectHandle = mResponse.getParameter(3);
             info->mStorageID = mResponse.getParameter(1);
             info->mParent = mResponse.getParameter(2);
             info->mHandle = mResponse.getParameter(3);
@@ -502,9 +506,14 @@
 bool MtpDevice::sendObject(MtpObjectHandle handle, int size, int srcFD) {
     Mutex::Autolock autoLock(mMutex);
 
+    if (mLastSendObjectInfoTransactionID + 1 != mTransactionID ||
+            mLastSendObjectInfoObjectHandle != handle) {
+        ALOGE("A sendObject request must follow the sendObjectInfo request.");
+        return false;
+    }
+
     int remaining = size;
     mRequest.reset();
-    mRequest.setParameter(1, handle);
     bool error = false;
     if (sendRequest(MTP_OPERATION_SEND_OBJECT)) {
         // send data header

media/mtp/MtpDevice.h

diff --git a/media/mtp/MtpDevice.h b/media/mtp/MtpDevice.h
index 4be44cf..b65e098 100644
--- a/media/mtp/MtpDevice.h
+++ b/media/mtp/MtpDevice.h
@@ -62,6 +62,10 @@
     bool                    mProcessingEvent;
     int                     mCurrentEventHandle;
 
+    // to check if a sendObject request follows the last sendObjectInfo request.
+    MtpTransactionID        mLastSendObjectInfoTransactionID;
+    MtpObjectHandle         mLastSendObjectInfoObjectHandle;
+
     // to ensure only one MTP transaction at a time
     Mutex                   mMutex;
     Mutex                   mEventMutex;