commit 2afac0c7c42560ff5b8f133c6074b7e023279d6d
author Wei Jia <wjia@google.com> Thu Jan 07 12:13:07 2016 -0800
committer Wei Jia <wjia@google.com> Thu Jan 07 15:20:31 2016 -0800
tree f541f9d2de183b5b24c857bdf5995845b22efb2b
parent df9e6aaf716279baf0e27b99acf10005924245ed

libmedia: check NULL pointer at binder receiver side.

Change-Id: I464da96f3d6081dd8c3cc2fd977e2b96f5d477bb

media/libmedia/IMediaMetadataRetriever.cpp

diff --git a/media/libmedia/IMediaMetadataRetriever.cpp b/media/libmedia/IMediaMetadataRetriever.cpp
index dbf524e..0bee8d3 100644
--- a/media/libmedia/IMediaMetadataRetriever.cpp
+++ b/media/libmedia/IMediaMetadataRetriever.cpp
@@ -224,6 +224,11 @@
 
             const char* srcUrl = data.readCString();
 
+            if (httpService == NULL || srcUrl == NULL) {
+                reply->writeInt32(BAD_VALUE);
+                return NO_ERROR;
+            }
+
             KeyedVector<String8, String8> headers;
             size_t numHeaders = (size_t) data.readInt64();
             for (size_t i = 0; i < numHeaders; ++i) {
@@ -250,7 +255,11 @@
             CHECK_INTERFACE(IMediaMetadataRetriever, data, reply);
             sp<IDataSource> source =
                 interface_cast<IDataSource>(data.readStrongBinder());
-            reply->writeInt32(setDataSource(source));
+            if (source == NULL) {
+                reply->writeInt32(BAD_VALUE);
+            } else {
+                reply->writeInt32(setDataSource(source));
+            }
             return NO_ERROR;
         } break;
         case GET_FRAME_AT_TIME: {