Fix uninitialized read in gif extension reading
Use memcmp instead of strcmp, since string stored in gif may not be
null terminated.
Additionally, pass the correct carray for releasing the byte array.
Change-Id: Icb0260c953377d17b7dd7b4fb021147181cd5df8
diff --git a/framesequence/jni/FrameSequenceJNI.cpp b/framesequence/jni/FrameSequenceJNI.cpp
index efeed7e..08a73bc 100644
--- a/framesequence/jni/FrameSequenceJNI.cpp
+++ b/framesequence/jni/FrameSequenceJNI.cpp
@@ -53,8 +53,7 @@
"couldn't read array bytes");
return NULL;
}
- bytes += offset;
- MemoryStream stream(bytes, length);
+ MemoryStream stream(bytes + offset, length);
FrameSequence* frameSequence = FrameSequence::create(&stream);
env->ReleasePrimitiveArrayCritical(byteArray, bytes, 0);
return createJavaFrameSequence(env, frameSequence);
diff --git a/framesequence/jni/FrameSequence_gif.cpp b/framesequence/jni/FrameSequence_gif.cpp
index 2402439..daa097b 100644
--- a/framesequence/jni/FrameSequence_gif.cpp
+++ b/framesequence/jni/FrameSequence_gif.cpp
@@ -81,14 +81,14 @@
for (int j = 0; (j + 1) < image.ExtensionBlockCount; j++) {
ExtensionBlock* eb1 = image.ExtensionBlocks + j;
ExtensionBlock* eb2 = image.ExtensionBlocks + j + 1;
- if (eb1->Function == APPLICATION_EXT_FUNC_CODE &&
+ if (eb1->Function == APPLICATION_EXT_FUNC_CODE
// look for "NETSCAPE2.0" app extension
- eb1->ByteCount == 11 &&
- !strcmp((const char*)(eb1->Bytes), "NETSCAPE2.0") &&
+ && eb1->ByteCount == 11
+ && !memcmp((const char*)(eb1->Bytes), "NETSCAPE2.0", 11)
// verify extension contents and get loop count
- eb2->Function == CONTINUE_EXT_FUNC_CODE &&
- eb2->ByteCount == 3 &&
- eb2->Bytes[0] == 1) {
+ && eb2->Function == CONTINUE_EXT_FUNC_CODE
+ && eb2->ByteCount == 3
+ && eb2->Bytes[0] == 1) {
mLoopCount = (int)(eb2->Bytes[2] & 0xff) + (int)(eb2->Bytes[1] & 0xff);
}
}