commit 77d90c3917c364add41e6b0ff0510ce9c6e0b54f
author Romain Guy <romainguy@google.com> Mon Mar 29 16:31:14 2010 -0700
committer Android (Google) Code Review <android-gerrit@google.com> Mon Mar 29 16:31:14 2010 -0700
tree 8652850ea1b71670da1d7dd4420a16676827c007
parent c088fd6a709adff1cd439fe4253f5eb07d239916
parent 3a22b0982aea3442a3e9d1f1861a9d848e14b02d

Merge "Fix possible security issue. Bug #2553187" into froyo

libs/utils/VectorImpl.cpp

diff --git a/libs/utils/VectorImpl.cpp b/libs/utils/VectorImpl.cpp
index 2c2d667..0322af7 100644
--- a/libs/utils/VectorImpl.cpp
+++ b/libs/utils/VectorImpl.cpp
@@ -173,9 +173,10 @@
                     if (!array) return NO_MEMORY;
                     temp = malloc(mItemSize);
                     if (!temp) return NO_MEMORY;
-                    _do_construct(temp, 1);
                     item = reinterpret_cast<char*>(array) + mItemSize*(i);
                     curr = reinterpret_cast<char*>(array) + mItemSize*(i-1);
+                } else {
+                    _do_destroy(temp, 1);
                 }
 
                 _do_copy(temp, item, 1);
@@ -183,12 +184,14 @@
                 ssize_t j = i-1;
                 void* next = reinterpret_cast<char*>(array) + mItemSize*(i);                    
                 do {
+                    _do_destroy(next, 1);
                     _do_copy(next, curr, 1);
                     next = curr;
                     --j;
                     curr = reinterpret_cast<char*>(array) + mItemSize*(j);                    
                 } while (j>=0 && (cmp(curr, temp, state) > 0));
 
+                _do_destroy(next, 1);
                 _do_copy(next, temp, 1);
             }
             i++;

opengl/libs/GLES2/gl2.cpp

diff --git a/opengl/libs/GLES2/gl2.cpp b/opengl/libs/GLES2/gl2.cpp
index b8e3283..924737e 100644
--- a/opengl/libs/GLES2/gl2.cpp
+++ b/opengl/libs/GLES2/gl2.cpp
@@ -114,6 +114,6 @@
 {
     GLeglImageOES implImage = 
         (GLeglImageOES)egl_get_image_for_current_context((EGLImageKHR)image);
-    __glEGLImageTargetRenderbufferStorageOES(target, image);
+    __glEGLImageTargetRenderbufferStorageOES(target, implImage);
 }
 

opengl/libs/GLES_CM/gl.cpp

diff --git a/opengl/libs/GLES_CM/gl.cpp b/opengl/libs/GLES_CM/gl.cpp
index e7757a8..d71ff76 100644
--- a/opengl/libs/GLES_CM/gl.cpp
+++ b/opengl/libs/GLES_CM/gl.cpp
@@ -185,6 +185,6 @@
 {
     GLeglImageOES implImage = 
         (GLeglImageOES)egl_get_image_for_current_context((EGLImageKHR)image);
-    __glEGLImageTargetRenderbufferStorageOES(target, image);
+    __glEGLImageTargetRenderbufferStorageOES(target, implImage);
 }