commit d63a1d1644ece3585813bb36028dcf323954eaba
author Treehugger Robot <android-test-infra-autosubmit@system.gserviceaccount.com> Wed Apr 12 12:19:43 2023 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Wed Apr 12 12:19:43 2023 +0000
tree a595a4f1066fb76d5ce805e667a36e0074c176cd
parent e593fef839d6ed2335a71b51a2153d780b97d630
parent 1ef49b8757f8aa3c0515e05a5c69d3b95a2d3416

Merge "Catch nullptr possibilities in MediaExtractor jni code" into udc-dev

media/jni/android_media_MediaExtractor.cpp

diff --git a/media/jni/android_media_MediaExtractor.cpp b/media/jni/android_media_MediaExtractor.cpp
index 116237f..609c7a4 100644
--- a/media/jni/android_media_MediaExtractor.cpp
+++ b/media/jni/android_media_MediaExtractor.cpp
@@ -196,6 +196,15 @@
         dstSize = (size_t) env->GetDirectBufferCapacity(byteBuf);
     }
 
+    // unlikely, but GetByteArrayElements() can fail
+    if (dst == nullptr) {
+        ALOGE("no buffer into which to read the data");
+        if (byteArray != NULL) {
+            env->ReleaseByteArrayElements(byteArray, (jbyte *)dst, 0);
+        }
+        return -ENOMEM;
+    }
+
     if (dstSize < offset) {
         if (byteArray != NULL) {
             env->ReleaseByteArrayElements(byteArray, (jbyte *)dst, 0);
@@ -204,8 +213,10 @@
         return -ERANGE;
     }
 
+    // passes in the backing memory to use, so it doesn't fail
     sp<ABuffer> buffer = new ABuffer((char *)dst + offset, dstSize - offset);
 
+    buffer->setRange(0, 0);  // mark it empty
     status_t err = mImpl->readSampleData(buffer);
 
     if (byteArray != NULL) {