diff options
| -rw-r--r-- | AndroidManifest.xml | 6 | ||||
| -rw-r--r-- | jni/GifTranscoder.cpp | 5 | ||||
| -rw-r--r-- | src/com/android/messaging/datamodel/MediaScratchFileProvider.java | 18 | ||||
| -rw-r--r-- | src/com/android/messaging/datamodel/MmsFileProvider.java | 19 |
4 files changed, 44 insertions, 4 deletions
diff --git a/AndroidManifest.xml b/AndroidManifest.xml index 8fe8fae..4b16a82 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -317,11 +317,13 @@ <provider android:name=".datamodel.MmsFileProvider" android:authorities="com.android.messaging.datamodel.MmsFileProvider" - android:grantUriPermissions="true" /> + android:grantUriPermissions="true" + android:exported="false" /> <provider android:name=".datamodel.MediaScratchFileProvider" android:authorities="com.android.messaging.datamodel.MediaScratchFileProvider" - android:grantUriPermissions="true" /> + android:grantUriPermissions="true" + android:exported="false" /> <!-- Action Services --> diff --git a/jni/GifTranscoder.cpp b/jni/GifTranscoder.cpp index 44fa30c..0d50770 100644 --- a/jni/GifTranscoder.cpp +++ b/jni/GifTranscoder.cpp @@ -274,6 +274,11 @@ bool GifTranscoder::resizeBoxFilter(GifFileType* gifIn, GifFileType* gifOut) { // matches what libframesequence (Rastermill) does. if (imageIndex == 0 && gifIn->SColorMap) { if (gcb.TransparentColor == NO_TRANSPARENT_COLOR) { + if (gifIn->SBackGroundColor < 0 || + gifIn->SBackGroundColor >= gifIn->SColorMap->ColorCount) { + LOGE("SBackGroundColor overflow"); + return false; + } GifColorType bgColorIndex = gifIn->SColorMap->Colors[gifIn->SBackGroundColor]; bgColor = gifColorToColorARGB(bgColorIndex); diff --git a/src/com/android/messaging/datamodel/MediaScratchFileProvider.java b/src/com/android/messaging/datamodel/MediaScratchFileProvider.java index 29ae4f4..a19523f 100644 --- a/src/com/android/messaging/datamodel/MediaScratchFileProvider.java +++ b/src/com/android/messaging/datamodel/MediaScratchFileProvider.java @@ -32,6 +32,7 @@ import com.android.messaging.util.LogUtil; import com.google.common.annotations.VisibleForTesting; import java.io.File; +import java.io.IOException; import java.util.List; /** @@ -89,8 +90,23 @@ public class MediaScratchFileProvider extends FileProvider { private static File getFileWithExtension(final String path, final String extension) { final Context context = Factory.get().getApplicationContext(); - return new File(getDirectory(context), + final File filePath = new File(getDirectory(context), TextUtils.isEmpty(extension) ? path : path + "." + extension); + + try { + if (!filePath.getCanonicalPath() + .startsWith(getDirectory(context).getCanonicalPath())) { + LogUtil.e(TAG, "getFileWithExtension: path " + + filePath.getCanonicalPath() + + " does not start with " + + getDirectory(context).getCanonicalPath()); + return null; + } + } catch (IOException e) { + LogUtil.e(TAG, "getFileWithExtension: getCanonicalPath failed ", e); + return null; + } + return filePath; } private static File getDirectory(final Context context) { diff --git a/src/com/android/messaging/datamodel/MmsFileProvider.java b/src/com/android/messaging/datamodel/MmsFileProvider.java index 0022630..eb49802 100644 --- a/src/com/android/messaging/datamodel/MmsFileProvider.java +++ b/src/com/android/messaging/datamodel/MmsFileProvider.java @@ -18,12 +18,14 @@ package com.android.messaging.datamodel; import android.content.Context; import android.net.Uri; +import android.text.TextUtils; import com.android.messaging.Factory; import com.android.messaging.util.LogUtil; import com.google.common.annotations.VisibleForTesting; import java.io.File; +import java.io.IOException; /** * A very simple content provider that can serve mms files from our cache directory. @@ -60,7 +62,22 @@ public class MmsFileProvider extends FileProvider { private static File getFile(final String path) { final Context context = Factory.get().getApplicationContext(); - return new File(getDirectory(context), path + ".dat"); + final File filePath = new File(getDirectory(context), path + ".dat"); + + try { + if (!filePath.getCanonicalPath() + .startsWith(getDirectory(context).getCanonicalPath())) { + LogUtil.e(TAG, "getFile: path " + + filePath.getCanonicalPath() + + " does not start with " + + getDirectory(context).getCanonicalPath()); + return null; + } + } catch (IOException e) { + LogUtil.e(TAG, "getFile: getCanonicalPath failed ", e); + return null; + } + return filePath; } private static File getDirectory(final Context context) { |