commit 5c66471ad288640a89188f765fef5b41b4d3daf5
author Daichi Hirono <hirono@google.com> Tue Oct 04 17:45:31 2016 +0900
committer Daichi Hirono <hirono@google.com> Wed Jan 11 01:37:52 2017 +0000
tree 16dffa5cea0670d5038bd96408f422473ca0ff21
parent cb85a295a44eb5e3f639e2a29499b51ebf2cd012

Stop sending object handle with sendObject request.

According to the MTP spec, the sendObject request must follow
sendObjectInfo request and we could not send an object handle with
sendObject request. The CL stops sending object handle with a sendObject
request. Instead it checks if the given object handle equals to the
object handle returned by the previous sendObjectInfo request.

Bug: 31918048
Test: manually invoked sendObjectInfo and sendObject.
Change-Id: I0a80bdf67bf2913522821ac705f3dc548d3edead
(cherry picked from commit 8d20945c08dfdd85c252c8ba92d197bf1bd2b208)

media/mtp/MtpDevice.cpp

diff --git a/media/mtp/MtpDevice.cpp b/media/mtp/MtpDevice.cpp
index bd89a51..7301193 100644
--- a/media/mtp/MtpDevice.cpp
+++ b/media/mtp/MtpDevice.cpp
@@ -220,7 +220,9 @@
         mTransactionID(0),
         mReceivedResponse(false),
         mProcessingEvent(false),
-        mCurrentEventHandle(0)
+        mCurrentEventHandle(0),
+        mLastSendObjectInfoTransactionID(0),
+        mLastSendObjectInfoObjectHandle(0)
 {
     mRequestIn1 = usb_request_new(device, ep_in);
     mRequestIn2 = usb_request_new(device, ep_in);
@@ -490,6 +492,8 @@
    if (sendRequest(MTP_OPERATION_SEND_OBJECT_INFO) && sendData()) {
         MtpResponseCode ret = readResponse();
         if (ret == MTP_RESPONSE_OK) {
+            mLastSendObjectInfoTransactionID = mRequest.getTransactionID();
+            mLastSendObjectInfoObjectHandle = mResponse.getParameter(3);
             info->mStorageID = mResponse.getParameter(1);
             info->mParent = mResponse.getParameter(2);
             info->mHandle = mResponse.getParameter(3);
@@ -502,9 +506,14 @@
 bool MtpDevice::sendObject(MtpObjectHandle handle, int size, int srcFD) {
     Mutex::Autolock autoLock(mMutex);
 
+    if (mLastSendObjectInfoTransactionID + 1 != mTransactionID ||
+            mLastSendObjectInfoObjectHandle != handle) {
+        ALOGE("A sendObject request must follow the sendObjectInfo request.");
+        return false;
+    }
+
     int remaining = size;
     mRequest.reset();
-    mRequest.setParameter(1, handle);
     bool error = false;
     if (sendRequest(MTP_OPERATION_SEND_OBJECT)) {
         // send data header

media/mtp/MtpDevice.h

diff --git a/media/mtp/MtpDevice.h b/media/mtp/MtpDevice.h
index 4be44cf..b65e098 100644
--- a/media/mtp/MtpDevice.h
+++ b/media/mtp/MtpDevice.h
@@ -62,6 +62,10 @@
     bool                    mProcessingEvent;
     int                     mCurrentEventHandle;
 
+    // to check if a sendObject request follows the last sendObjectInfo request.
+    MtpTransactionID        mLastSendObjectInfoTransactionID;
+    MtpObjectHandle         mLastSendObjectInfoObjectHandle;
+
     // to ensure only one MTP transaction at a time
     Mutex                   mMutex;
     Mutex                   mEventMutex;