Merge "MTP: Improve argument checking in SendObjectInfo"

5 files changed, 38 insertions, 19 deletions

diff --git a/media/java/android/media/MtpDatabase.java b/media/java/android/media/MtpDatabase.java
index 6056a0f85904..4a9e483117d4 100644
--- a/media/java/android/media/MtpDatabase.java
+++ b/media/java/android/media/MtpDatabase.java
@@ -76,10 +76,11 @@ public class MtpDatabase {
             Files.FileColumns._ID, // 0
             Files.FileColumns.DATA, // 1
     };
-    private static final String[] PATH_SIZE_PROJECTION = new String[] {
+    private static final String[] PATH_SIZE_FORMAT_PROJECTION = new String[] {
             Files.FileColumns._ID, // 0
             Files.FileColumns.DATA, // 1
             Files.FileColumns.SIZE, // 2
+            Files.FileColumns.FORMAT, // 3
     };
     private static final String[] OBJECT_INFO_PROJECTION = new String[] {
             Files.FileColumns._ID, // 0
@@ -670,24 +671,26 @@ public class MtpDatabase {
         return false;
     }
 
-    private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLength) {
+    private int getObjectFilePath(int handle, char[] outFilePath, long[] outFileLengthFormat) {
         Log.d(TAG, "getObjectFilePath: " + handle);
         if (handle == 0) {
             // special case root directory
             mMediaStoragePath.getChars(0, mMediaStoragePath.length(), outFilePath, 0);
             outFilePath[mMediaStoragePath.length()] = 0;
-            outFileLength[0] = 0;
+            outFileLengthFormat[0] = 0;
+            outFileLengthFormat[1] = MtpConstants.FORMAT_ASSOCIATION;
             return MtpConstants.RESPONSE_OK;
         }
         Cursor c = null;
         try {
-            c = mMediaProvider.query(mObjectsUri, PATH_SIZE_PROJECTION,
+            c = mMediaProvider.query(mObjectsUri, PATH_SIZE_FORMAT_PROJECTION,
                             ID_WHERE, new String[] {  Integer.toString(handle) }, null);
             if (c != null && c.moveToNext()) {
                 String path = externalToMediaPath(c.getString(1));
                 path.getChars(0, path.length(), outFilePath, 0);
                 outFilePath[path.length()] = 0;
-                outFileLength[0] = c.getLong(2);
+                outFileLengthFormat[0] = c.getLong(2);
+                outFileLengthFormat[1] = c.getLong(3);
                 return MtpConstants.RESPONSE_OK;
             } else {
                 return MtpConstants.RESPONSE_INVALID_OBJECT_HANDLE;
diff --git a/media/jni/android_media_MtpDatabase.cpp b/media/jni/android_media_MtpDatabase.cpp
index 9bb93fd915a4..bce124130e3a 100644
--- a/media/jni/android_media_MtpDatabase.cpp
+++ b/media/jni/android_media_MtpDatabase.cpp
@@ -142,8 +142,9 @@ public:
                                             MtpDataPacket& packet);
 
     virtual MtpResponseCode         getObjectFilePath(MtpObjectHandle handle,
-                                            MtpString& filePath,
-                                            int64_t& fileLength);
+                                            MtpString& outFilePath,
+                                            int64_t& outFileLength,
+                                            MtpObjectFormat& outFormat);
     virtual MtpResponseCode         deleteFile(MtpObjectHandle handle);
 
     bool                            getObjectPropertyInfo(MtpObjectProperty property, int& type);
@@ -801,8 +802,9 @@ MtpResponseCode MyMtpDatabase::getObjectInfo(MtpObjectHandle handle,
 }
 
 MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle,
-                                            MtpString& filePath,
-                                            int64_t& fileLength) {
+                                            MtpString& outFilePath,
+                                            int64_t& outFileLength,
+                                            MtpObjectFormat& outFormat) {
     JNIEnv* env = AndroidRuntime::getJNIEnv();
     jint result = env->CallIntMethod(mDatabase, method_getObjectFilePath,
                 (jint)handle, mStringBuffer, mLongBuffer);
@@ -812,11 +814,12 @@ MtpResponseCode MyMtpDatabase::getObjectFilePath(MtpObjectHandle handle,
     }
 
     jchar* str = env->GetCharArrayElements(mStringBuffer, 0);
-    filePath.setTo(str, strlen16(str));
+    outFilePath.setTo(str, strlen16(str));
     env->ReleaseCharArrayElements(mStringBuffer, str, 0);
 
     jlong* longValues = env->GetLongArrayElements(mLongBuffer, 0);
-    fileLength = longValues[0];
+    outFileLength = longValues[0];
+    outFormat = longValues[1];
     env->ReleaseLongArrayElements(mLongBuffer, longValues, 0);
     
     checkAndClearExceptionFromCallback(env, __FUNCTION__);
diff --git a/media/mtp/MtpDatabase.h b/media/mtp/MtpDatabase.h
index 992980570a92..6dcb931ad1cf 100644
--- a/media/mtp/MtpDatabase.h
+++ b/media/mtp/MtpDatabase.h
@@ -85,8 +85,9 @@ public:
                                             MtpDataPacket& packet) = 0;
 
     virtual MtpResponseCode         getObjectFilePath(MtpObjectHandle handle,
-                                            MtpString& filePath,
-                                            int64_t& fileLength) = 0;
+                                            MtpString& outFilePath,
+                                            int64_t& outFileLength,
+                                            MtpObjectFormat& outFormat) = 0;
 
     virtual MtpResponseCode         deleteFile(MtpObjectHandle handle) = 0;
 
diff --git a/media/mtp/MtpProperty.cpp b/media/mtp/MtpProperty.cpp
index b095ce1888af..8016c352dbbc 100644
--- a/media/mtp/MtpProperty.cpp
+++ b/media/mtp/MtpProperty.cpp
@@ -343,6 +343,7 @@ void MtpProperty::print() {
             print(mMaximumValue, buffer);
             buffer += ", ";
             print(mStepSize, buffer);
+            buffer += ")";
             LOGI("%s", (const char *)buffer);
             break;
         case kFormEnum:
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index 5c1e02acec5e..d65845db4aee 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -112,8 +112,10 @@ void MtpServer::addStorage(const char* filePath) {
 }
 
 MtpStorage* MtpServer::getStorage(MtpStorageID id) {
+    if (id == 0)
+        return mStorages[0];
     for (int i = 0; i < mStorages.size(); i++) {
-        MtpStorage* storage =  mStorages[i];
+        MtpStorage* storage = mStorages[i];
         if (storage->getStorageID() == id)
             return storage;
     }
@@ -557,7 +559,8 @@ MtpResponseCode MtpServer::doGetObject() {
     MtpObjectHandle handle = mRequest.getParameter(1);
     MtpString pathBuf;
     int64_t fileLength;
-    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);
+    MtpObjectFormat format;
+    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);
     if (result != MTP_RESPONSE_OK)
         return result;
 
@@ -593,7 +596,8 @@ MtpResponseCode MtpServer::doGetPartialObject() {
     uint32_t length = mRequest.getParameter(3);
     MtpString pathBuf;
     int64_t fileLength;
-    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength);
+    MtpObjectFormat format;
+    int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);
     if (result != MTP_RESPONSE_OK)
         return result;
     if (offset + length > fileLength)
@@ -639,10 +643,13 @@ MtpResponseCode MtpServer::doSendObjectInfo() {
         path = storage->getPath();
         parent = 0;
     } else {
-        int64_t dummy;
-        int result = mDatabase->getObjectFilePath(parent, path, dummy);
+        int64_t length;
+        MtpObjectFormat format;
+        int result = mDatabase->getObjectFilePath(parent, path, length, format);
         if (result != MTP_RESPONSE_OK)
             return result;
+        if (format != MTP_FORMAT_ASSOCIATION)
+            return MTP_RESPONSE_INVALID_PARENT_OBJECT;
     }
 
     // read only the fields we need
@@ -676,6 +683,10 @@ MtpResponseCode MtpServer::doSendObjectInfo() {
         path += "/";
     path += (const char *)name;
 
+    // file should not already exist
+    if (access(path, R_OK) == 0)
+        return MTP_RESPONSE_GENERAL_ERROR;
+
     MtpObjectHandle handle = mDatabase->beginSendObject((const char*)path,
             format, parent, storageID, mSendObjectFileSize, modifiedTime);
     if (handle == kInvalidObjectHandle) {
@@ -835,7 +846,7 @@ MtpResponseCode MtpServer::doDeleteObject() {
 
     MtpString filePath;
     int64_t fileLength;
-    int result = mDatabase->getObjectFilePath(handle, filePath, fileLength);
+    int result = mDatabase->getObjectFilePath(handle, filePath, fileLength, format);
     if (result == MTP_RESPONSE_OK) {
         LOGV("deleting %s", (const char *)filePath);
         deletePath((const char *)filePath);