Avoid invalid memory access when using extractMetadata()

BpMediaMetadataRetriever::extractMetadata() returns a string
which is returned by readCString() function of the reply parcel object.
However, the parcel object is destroyed at the end of the
extractMetadata() function, and so the returned pointer is invalid.
This patch fixes this problem by storing the metadata string value.

Change-Id: I2a2ccba78246175b2845a237679d6cebe881e83b
Signed-off-by: Sangkyu Lee <sk82.lee@lge.com>

1 files changed, 16 insertions, 1 deletions

diff --git a/media/libmedia/IMediaMetadataRetriever.cpp b/media/libmedia/IMediaMetadataRetriever.cpp
index 7e6d54bd..bb066a00 100644
--- a/media/libmedia/IMediaMetadataRetriever.cpp
+++ b/media/libmedia/IMediaMetadataRetriever.cpp
@@ -20,6 +20,7 @@
 #include <binder/Parcel.h>
 #include <media/IMediaMetadataRetriever.h>
 #include <utils/String8.h>
+#include <utils/KeyedVector.h>
 
 // The binder is supposed to propagate the scheduler group across
 // the binder interface so that remote calls are executed with
@@ -161,8 +162,22 @@ public:
         if (ret != NO_ERROR) {
             return NULL;
         }
-        return reply.readCString();
+        const char* str = reply.readCString();
+        if (str != NULL) {
+            String8 value(str);
+            if (mMetadata.indexOfKey(keyCode) < 0) {
+                mMetadata.add(keyCode, value);
+            } else {
+                mMetadata.replaceValueFor(keyCode, value);
+            }
+            return mMetadata.valueFor(keyCode).string();
+        } else {
+            return NULL;
+        }
     }
+
+private:
+    KeyedVector<int, String8> mMetadata;
 };
 
 IMPLEMENT_META_INTERFACE(MediaMetadataRetriever, "android.media.IMediaMetadataRetriever");