Merge lp:~phablet-team/mtp/aosp-update into lp:mtp

[Alfonso Sanchez-Beato]

* Update to latest AOSP code (Marshallow)
* Make MTP work for file > 4GB (LP: #1472789). This involved adding O_LARGEFILE flag when opening a file (the flag is automatically added by bionic, but not by glibc) and fixing parts of the MTP database implementation.

* Update to latest AOSP code (Marshallow)
* Make MTP work for file > 4GB (LP: #1472789). This involved adding O_LARGEFILE flag when opening a file (the flag is automatically added by bionic, but not by glibc) and fixing parts of the MTP database implementation.

[Konrad Zapałowicz (kzapalowicz)]

Minor issues mostly related to type-safety

review: Needs Fixing (code)

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

Thanks for the thorough review. However, most of the code comes directly from AOSP, and I have preferred in many cases to minimize the difference between our project and "upstream" to ease future merges. AOSP code can be found in:

https://android.googlesource.com/platform/frameworks/av/

[lp:~phablet-team/mtp/aosp-update]

74. By Alfonso Sanchez-Beato on 2016-04-12

Address review comments

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

Branch refreshed after addressing review comments.

[Simon Fels (morphis)]

LGTM

review: Approve

[Konrad Zapałowicz (kzapalowicz)]

Approved

review: Approve (code)

=== modified file 'CMakeLists.txt'
--- CMakeLists.txt	2014-09-04 01:11:14 +0000
+++ CMakeLists.txt	2016-04-12 16:15:02 +0000
@@ -7,7 +7,7 @@
 
 set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
 
-add_definitions(-DMTP_DEVICE -DMTP_HOST)
+add_definitions(-DMTP_DEVICE -DMTP_HOST -D_FILE_OFFSET_BITS=64)
 
 set(MTP_VERSION_MAJOR 1)
 set(MTP_VERSION_MINOR 0)
 
=== modified file 'include/MtpDataPacket.h'
--- include/MtpDataPacket.h	2013-06-13 10:22:21 +0000
+++ include/MtpDataPacket.h	2016-04-12 16:15:02 +0000
@@ -30,7 +30,7 @@
 class MtpDataPacket : public MtpPacket {
 private:
     // current offset for get/put methods
-    int                 mOffset;
+    size_t              mOffset;
 
 public:
                         MtpDataPacket();
@@ -42,17 +42,18 @@
     void                setTransactionID(MtpTransactionID id);
 
     inline const uint8_t*     getData() const { return mBuffer + MTP_CONTAINER_HEADER_SIZE; }
-    inline uint8_t      getUInt8() { return (uint8_t)mBuffer[mOffset++]; }
-    inline int8_t       getInt8() { return (int8_t)mBuffer[mOffset++]; }
-    uint16_t            getUInt16();
-    inline int16_t      getInt16() { return (int16_t)getUInt16(); }
-    uint32_t            getUInt32();
-    inline int32_t      getInt32() { return (int32_t)getUInt32(); }
-    uint64_t            getUInt64();
-    inline int64_t      getInt64() { return (int64_t)getUInt64(); }
-    void                getUInt128(uint128_t& value);
-    inline void         getInt128(int128_t& value) { getUInt128((uint128_t&)value); }
-    void                getString(MtpStringBuffer& string);
+
+    bool                getUInt8(uint8_t& value);
+    inline bool         getInt8(int8_t& value) { return getUInt8((uint8_t&)value); }
+    bool                getUInt16(uint16_t& value);
+    inline bool         getInt16(int16_t& value) { return getUInt16((uint16_t&)value); }
+    bool                getUInt32(uint32_t& value);
+    inline bool         getInt32(int32_t& value) { return getUInt32((uint32_t&)value); }
+    bool                getUInt64(uint64_t& value);
+    inline bool         getInt64(int64_t& value) { return getUInt64((uint64_t&)value); }
+    bool                getUInt128(uint128_t& value);
+    inline bool         getInt128(int128_t& value) { return getUInt128((uint128_t&)value); }
+    bool                getString(MtpStringBuffer& string);
 
     Int8List*           getAInt8();
     UInt8List*          getAUInt8();
 
=== modified file 'include/MtpDevice.h'
--- include/MtpDevice.h	2013-06-13 10:22:21 +0000
+++ include/MtpDevice.h	2016-04-12 16:15:02 +0000
@@ -96,7 +96,7 @@
     bool                    readObject(MtpObjectHandle handle,
                                     bool (* callback)(void* data, int offset,
                                             int length, void* clientData),
-                                    int objectSize, void* clientData);
+                                    size_t objectSize, void* clientData);
     bool                    readObject(MtpObjectHandle handle, const char* destPath, int group,
                                     int perm);
 
 
=== modified file 'include/MtpDeviceInfo.h'
--- include/MtpDeviceInfo.h	2013-06-13 10:22:21 +0000
+++ include/MtpDeviceInfo.h	2016-04-12 16:15:02 +0000
@@ -29,7 +29,7 @@
     uint32_t                mVendorExtensionID;
     uint16_t                mVendorExtensionVersion;
     char*                   mVendorExtensionDesc;
-    uint16_t                mFunctionalCode;
+    uint16_t                mFunctionalMode;
     UInt16List*             mOperations;
     UInt16List*             mEvents;
     MtpDevicePropertyList*  mDeviceProperties;
@@ -44,7 +44,7 @@
                             MtpDeviceInfo();
     virtual                 ~MtpDeviceInfo();
 
-    void                    read(MtpDataPacket& packet);
+    bool                    read(MtpDataPacket& packet);
 
     void                    print();
 };
 
=== modified file 'include/MtpObjectInfo.h'
--- include/MtpObjectInfo.h	2013-06-13 10:22:21 +0000
+++ include/MtpObjectInfo.h	2016-04-12 16:15:02 +0000
@@ -50,7 +50,7 @@
                         MtpObjectInfo(MtpObjectHandle handle);
     virtual             ~MtpObjectInfo();
 
-    void                read(MtpDataPacket& packet);
+    bool                read(MtpDataPacket& packet);
 
     void                print();
 };
 
=== modified file 'include/MtpPacket.h'
--- include/MtpPacket.h	2013-06-13 10:22:21 +0000
+++ include/MtpPacket.h	2016-04-12 16:15:02 +0000
@@ -28,11 +28,11 @@
 protected:
     uint8_t*            mBuffer;
     // current size of the buffer
-    int                 mBufferSize;
+    size_t              mBufferSize;
     // number of bytes to add when resizing the buffer
-    int                 mAllocationIncrement;
+    size_t              mAllocationIncrement;
     // size of the data in the packet
-    int                 mPacketSize;
+    size_t              mPacketSize;
 
 public:
                         MtpPacket(int bufferSize);
@@ -41,7 +41,7 @@
     // sets packet size to the default container size and sets buffer to zero
     virtual void        reset();
 
-    void                allocate(int length);
+    void                allocate(size_t length);
     void                dump();
     void                copyFrom(const MtpPacket& src);
 
 
=== modified file 'include/MtpProperty.h'
--- include/MtpProperty.h	2013-06-13 10:22:21 +0000
+++ include/MtpProperty.h	2016-04-12 16:15:02 +0000
@@ -49,9 +49,9 @@
     MtpPropertyValue    mCurrentValue;
 
     // for array types
-    int                 mDefaultArrayLength;
+    uint32_t            mDefaultArrayLength;
     MtpPropertyValue*   mDefaultArrayValues;
-    int                 mCurrentArrayLength;
+    uint32_t            mCurrentArrayLength;
     MtpPropertyValue*   mCurrentArrayValues;
 
     enum {
@@ -70,7 +70,7 @@
     MtpPropertyValue    mStepSize;
 
     // for enum form
-    int                 mEnumLength;
+    uint16_t            mEnumLength;
     MtpPropertyValue*   mEnumValues;
 
 public:
@@ -83,7 +83,7 @@
 
     inline MtpPropertyCode getPropertyCode() const { return mCode; }
 
-    void                read(MtpDataPacket& packet);
+    bool                read(MtpDataPacket& packet);
     void                write(MtpDataPacket& packet);
 
     void                setDefaultValue(const uint16_t* string);
@@ -102,11 +102,11 @@
                         }
 
 private:
-    void                readValue(MtpDataPacket& packet, MtpPropertyValue& value);
+    bool                readValue(MtpDataPacket& packet, MtpPropertyValue& value);
     void                writeValue(MtpDataPacket& packet, MtpPropertyValue& value);
-    MtpPropertyValue*   readArrayValues(MtpDataPacket& packet, int& length);
+    MtpPropertyValue*   readArrayValues(MtpDataPacket& packet, uint32_t& length);
     void                writeArrayValues(MtpDataPacket& packet,
-                                            MtpPropertyValue* values, int length);
+                                            MtpPropertyValue* values, uint32_t length);
 };
 
 }; // namespace android
 
=== modified file 'include/MtpRequestPacket.h'
--- include/MtpRequestPacket.h	2013-06-13 10:22:21 +0000
+++ include/MtpRequestPacket.h	2016-04-12 16:15:02 +0000
@@ -43,6 +43,10 @@
     inline MtpOperationCode    getOperationCode() const { return getContainerCode(); }
     inline void                setOperationCode(MtpOperationCode code)
                                                     { return setContainerCode(code); }
+    inline int                  getParameterCount() const { return mParameterCount; }
+
+private:
+    int     mParameterCount;
 };
 
 }; // namespace android
 
=== modified file 'include/MtpServer.h'
--- include/MtpServer.h	2014-10-29 18:46:35 +0000
+++ include/MtpServer.h	2016-04-12 16:15:02 +0000
@@ -108,6 +108,7 @@
 
     void                sendObjectAdded(MtpObjectHandle handle);
     void                sendObjectRemoved(MtpObjectHandle handle);
+    void                sendDevicePropertyChanged(MtpDeviceProperty property);
     void                sendObjectInfoChanged(MtpObjectHandle handle);
     void                sendObjectPropChanged(MtpObjectHandle handle,
                                               MtpObjectProperty prop);
 
=== modified file 'include/MtpStorageInfo.h'
--- include/MtpStorageInfo.h	2013-06-13 10:22:21 +0000
+++ include/MtpStorageInfo.h	2016-04-12 16:15:02 +0000
@@ -39,7 +39,7 @@
                         MtpStorageInfo(MtpStorageID id);
     virtual             ~MtpStorageInfo();
 
-    void                read(MtpDataPacket& packet);
+    bool                read(MtpDataPacket& packet);
 
     void                print();
 };
 
=== modified file 'include/MtpStringBuffer.h'
--- include/MtpStringBuffer.h	2013-06-13 10:22:21 +0000
+++ include/MtpStringBuffer.h	2016-04-12 16:15:02 +0000
@@ -19,6 +19,9 @@
 
 #include <stdint.h>
 
+// Max Character number of a MTP String
+#define MTP_STRING_MAX_CHARACTER_NUMBER             255
+
 namespace android {
 
 class MtpDataPacket;
@@ -29,7 +32,7 @@
 private:
     // mBuffer contains string in UTF8 format
     // maximum 3 bytes/character, with 1 extra for zero termination
-    uint8_t         mBuffer[255 * 3 + 1];
+    uint8_t         mBuffer[MTP_STRING_MAX_CHARACTER_NUMBER * 3 + 1];
     int             mCharCount;
     int             mByteCount;
 
@@ -43,7 +46,7 @@
     void            set(const char* src);
     void            set(const uint16_t* src);
 
-    void            readFromPacket(MtpDataPacket* packet);
+    bool            readFromPacket(MtpDataPacket* packet);
     void            writeToPacket(MtpDataPacket* packet) const;
 
     inline int      getCharCount() const { return mCharCount; }
 
=== modified file 'server/UbuntuMtpDatabase.h'
--- server/UbuntuMtpDatabase.h	2015-01-26 19:35:23 +0000
+++ server/UbuntuMtpDatabase.h	2016-04-12 16:15:02 +0000
@@ -63,7 +63,7 @@
         MtpStorageID storage_id;
         MtpObjectFormat object_format;
         MtpObjectHandle parent;
-        size_t object_size;
+        uint64_t object_size;
         std::string display_name;
         std::string path;
         int watch_fd;
@@ -117,7 +117,7 @@
                                  IN_MODIFY | IN_CREATE | IN_DELETE);
     }
 
-    
+
     void add_file_entry(path p, MtpObjectHandle parent, MtpStorageID storage)
     {
         MtpObjectHandle handle = counter;
@@ -246,16 +246,16 @@
                         std::size_t transferred)
     {
         size_t processed = 0;
-     
+
         while(transferred - processed >= sizeof(inotify_event))
         {
             const char* cdata = processed + asio::buffer_cast<const char*>(buf.data());
             const inotify_event* ievent = reinterpret_cast<const inotify_event*>(cdata);
             MtpObjectHandle parent;
             path p;
-     
+
             processed += sizeof(inotify_event) + ievent->len;
-     
+
             BOOST_FOREACH(MtpObjectHandle i, db | boost::adaptors::map_keys) {
                 if (db.at(i).watch_fd == ievent->wd) {
                     parent = i;
@@ -329,7 +329,7 @@
                 }
             }
         }
-     
+
         read_more_notify();
     }
 
@@ -411,7 +411,7 @@
 
 	counter++;
 
-        return handle; 
+        return handle;
     }
 
     // called to report success or failure of the SendObject file transfer
@@ -470,7 +470,7 @@
         {
             list = new MtpObjectHandleList();
         }
-        
+
         return list;
     }
 
@@ -491,7 +491,7 @@
         } catch(...)
         {
         }
-        
+
         return result;
     }
 
@@ -540,14 +540,14 @@
 
         return new MtpObjectFormatList{list};
     }
-    
+
     virtual MtpObjectFormatList* getSupportedCaptureFormats()
     {
         VLOG(1) << __PRETTY_FUNCTION__;
         static const MtpObjectFormatList list = {MTP_FORMAT_ASSOCIATION, MTP_FORMAT_PNG};
         return new MtpObjectFormatList{list};
     }
-    
+
     virtual MtpObjectPropertyList* getSupportedObjectProperties(MtpObjectFormat format)
     {
         VLOG(1) << __PRETTY_FUNCTION__;
@@ -555,8 +555,8 @@
         if (format != MTP_FORMAT_PNG)
             return nullptr;
         */
-            
-        static const MtpObjectPropertyList list = 
+
+        static const MtpObjectPropertyList list =
         {
             MTP_PROPERTY_STORAGE_ID,
             MTP_PROPERTY_PARENT_OBJECT,
@@ -574,16 +574,16 @@
             MTP_PROPERTY_NON_CONSUMABLE,
 
         };
-         
+
         return new MtpObjectPropertyList{list};
     }
-    
+
     virtual MtpDevicePropertyList* getSupportedDeviceProperties()
     {
         VLOG(1) << __PRETTY_FUNCTION__;
         static const MtpDevicePropertyList list = {
             MTP_DEVICE_PROPERTY_DEVICE_FRIENDLY_NAME,
-            MTP_DEVICE_PROPERTY_SYNCHRONIZATION_PARTNER, 
+            MTP_DEVICE_PROPERTY_SYNCHRONIZATION_PARTNER,
         };
         return new MtpDevicePropertyList{list};
     }
@@ -592,7 +592,7 @@
         MtpObjectHandle handle,
         MtpObjectProperty property,
         MtpDataPacket& packet)
-    {        
+    {
         char date[20];
 
         VLOG(1) << __PRETTY_FUNCTION__
@@ -605,10 +605,10 @@
         try {
             switch(property)
             {
-                case MTP_PROPERTY_STORAGE_ID: packet.putUInt32(db.at(handle).storage_id); break;            
-                case MTP_PROPERTY_PARENT_OBJECT: packet.putUInt32(db.at(handle).parent); break;            
+                case MTP_PROPERTY_STORAGE_ID: packet.putUInt32(db.at(handle).storage_id); break;
+                case MTP_PROPERTY_PARENT_OBJECT: packet.putUInt32(db.at(handle).parent); break;
                 case MTP_PROPERTY_OBJECT_FORMAT: packet.putUInt16(db.at(handle).object_format); break;
-                case MTP_PROPERTY_OBJECT_SIZE: packet.putUInt32(db.at(handle).object_size); break;
+                case MTP_PROPERTY_OBJECT_SIZE: packet.putUInt64(db.at(handle).object_size); break;
                 case MTP_PROPERTY_DISPLAY_NAME: packet.putString(db.at(handle).display_name.c_str()); break;
                 case MTP_PROPERTY_OBJECT_FILE_NAME: packet.putString(db.at(handle).display_name.c_str()); break;
                 case MTP_PROPERTY_PERSISTENT_UID: packet.putUInt128(handle); break;
@@ -637,9 +637,9 @@
                     else
                         packet.putUInt16(1); // files can usually be played.
                     break;
-                default: return MTP_RESPONSE_GENERAL_ERROR; break;                
+                default: return MTP_RESPONSE_GENERAL_ERROR; break;
             }
-        
+
             return MTP_RESPONSE_OK;
         }
         catch (...) {
@@ -676,7 +676,10 @@
                 try {
                     entry = db.at(handle);
 
-                    packet.getString(buffer);
+                    if (!packet.getString(buffer)) {
+                        LOG(ERROR) << "Cannot read packet";
+                        return MTP_RESPONSE_GENERAL_ERROR;
+                    }
                     newname = strdup(buffer);
 
                     oldpath /= entry.path;
@@ -701,7 +704,10 @@
             case MTP_PROPERTY_PARENT_OBJECT:
                 try {
                     entry = db.at(handle);
-                    entry.parent = packet.getUInt32();
+                    if (!packet.getUInt32(entry.parent)) {
+                        LOG(ERROR) << "Cannot read packet";
+                        return MTP_RESPONSE_GENERAL_ERROR;
+                    }
                 }
                 catch (...) {
                     LOG(ERROR) << "Could not change parent object for handle "
@@ -710,7 +716,7 @@
                 }
             default: return MTP_RESPONSE_OPERATION_NOT_SUPPORTED; break;
         }
-        
+
         return MTP_RESPONSE_OK;
     }
 
@@ -727,7 +733,7 @@
                 break;
             default: return MTP_RESPONSE_OPERATION_NOT_SUPPORTED; break;
         }
-        
+
         return MTP_RESPONSE_OK;
     }
 
@@ -748,9 +754,9 @@
 
     virtual MtpResponseCode getObjectPropertyList(
         MtpObjectHandle handle,
-        uint32_t format, 
+        uint32_t format,
         uint32_t property,
-        int groupCode, 
+        int groupCode,
         int depth,
         MtpDataPacket& packet)
     {
@@ -841,8 +847,8 @@
             if (property == ALL_PROPERTIES || property == MTP_PROPERTY_OBJECT_SIZE) {
                 packet.putUInt32(i);
                 packet.putUInt16(MTP_PROPERTY_OBJECT_SIZE);
-                packet.putUInt16(MTP_TYPE_UINT32);
-                packet.putUInt32(entry.object_size);
+                packet.putUInt16(MTP_TYPE_UINT64);
+                packet.putUInt64(entry.object_size);
             }
 
             // Object File Name
@@ -944,11 +950,16 @@
             return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
 
         try {
+            uint64_t object_size = db.at(handle).object_size;
+
             info.mHandle = handle;
             info.mStorageID = db.at(handle).storage_id;
             info.mFormat = db.at(handle).object_format;
             info.mProtectionStatus = 0x0;
-            info.mCompressedSize = db.at(handle).object_size;
+            if (object_size > UINT64_C(0xFFFFFFFF))
+                info.mCompressedSize = UINT64_C(0xFFFFFFFF);
+            else
+                info.mCompressedSize = object_size;
             info.mImagePixWidth = 0;
             info.mImagePixHeight = 0;
             info.mImagePixDepth = 0;
@@ -1116,7 +1127,7 @@
             case MTP_PROPERTY_STORAGE_ID: result = new MtpProperty(property, MTP_TYPE_UINT32, false); break;
             case MTP_PROPERTY_PARENT_OBJECT: result = new MtpProperty(property, MTP_TYPE_UINT32, true); break;
             case MTP_PROPERTY_OBJECT_FORMAT: result = new MtpProperty(property, MTP_TYPE_UINT16, false); break;
-            case MTP_PROPERTY_OBJECT_SIZE: result = new MtpProperty(property, MTP_TYPE_UINT32, false); break;
+            case MTP_PROPERTY_OBJECT_SIZE: result = new MtpProperty(property, MTP_TYPE_UINT64, false); break;
             case MTP_PROPERTY_WIDTH: result = new MtpProperty(property, MTP_TYPE_UINT32, false); break;
             case MTP_PROPERTY_HEIGHT: result = new MtpProperty(property, MTP_TYPE_UINT32, false); break;
             case MTP_PROPERTY_IMAGE_BIT_DEPTH: result = new MtpProperty(property, MTP_TYPE_UINT32, false); break;
@@ -1130,9 +1141,9 @@
             case MTP_PROPERTY_DATE_MODIFIED: result = new MtpProperty(property, MTP_TYPE_STR, false); break;
             case MTP_PROPERTY_HIDDEN: result = new MtpProperty(property, MTP_TYPE_UINT16, false); break;
             case MTP_PROPERTY_NON_CONSUMABLE: result = new MtpProperty(property, MTP_TYPE_UINT16, false); break;
-            default: break;                
+            default: break;
         }
-        
+
         return result;
     }
 
@@ -1146,12 +1157,12 @@
             case MTP_DEVICE_PROPERTY_SYNCHRONIZATION_PARTNER:
             case MTP_DEVICE_PROPERTY_DEVICE_FRIENDLY_NAME:
                 result = new MtpProperty(property, MTP_TYPE_STR, false); break;
-            default: break;                
+            default: break;
         }
-        
+
         return result;
     }
-    
+
     virtual void sessionStarted(MtpServer* server)
     {
         VLOG(1) << __PRETTY_FUNCTION__;
 
=== modified file 'server/server.cpp'
--- server/server.cpp	2015-02-13 15:19:49 +0000
+++ server/server.cpp	2016-04-12 16:15:02 +0000
@@ -21,6 +21,7 @@
 #include <MtpStorage.h>
 
 #include <iostream>
+#include <stdint.h>
 
 #include <signal.h>
 #include <sys/types.h>
@@ -39,7 +40,7 @@
 #include <core/dbus/property.h>
 #include <core/dbus/service.h>
 #include <core/dbus/signal.h>
-    
+
 #include <core/dbus/asio/executor.h>
 #include <core/dbus/types/stl/tuple.h>
 #include <core/dbus/types/stl/vector.h>
@@ -76,23 +77,23 @@
 };
 }
 
-namespace core  
-{               
-namespace dbus      
-{               
+namespace core
+{
+namespace dbus
+{
 namespace traits
-{               
-template<>      
-struct Service<core::UnityGreeter> 
-{        
+{
+template<>
+struct Service<core::UnityGreeter>
+{
     inline static const std::string& interface_name()
     {
         static const std::string s
         {
             "com.canonical.UnityGreeter"
-        };      
+        };
         return s;
-    }               
+    }
 };
 }
 }
@@ -148,13 +149,14 @@
     {
         static int storageID = MTP_STORAGE_REMOVABLE_RAM;
 
+        /* TODO check removable file system type to set maximum file size */
         MtpStorage *removable = new MtpStorage(
-            storageID, 
+            storageID,
             path,
             name,
             1024 * 1024 * 100,  /* 100 MB reserved space, to avoid filling the disk */
             true,
-            1024 * 1024 * 1024 * 2  /* 2GB arbitrary max file size */);
+            UINT64_C(4294967295)  /* 4GB-1, we assume vfat here */);
 
         storageID++;
 
@@ -195,15 +197,15 @@
                          std::size_t transferred)
     {
         size_t processed = 0;
- 
+
         while(transferred - processed >= sizeof(inotify_event))
         {
             const char* cdata = processed + asio::buffer_cast<const char*>(buf.data());
             const inotify_event* ievent = reinterpret_cast<const inotify_event*>(cdata);
             path storage_path ("/media");
-     
+
             processed += sizeof(inotify_event) + ievent->len;
-     
+
             storage_path /= userdata->pw_name;
 
             if (ievent->len > 0 && ievent->mask & IN_CREATE)
@@ -277,11 +279,11 @@
 
         // MTP server
         server = new MtpServer(
-                fd, 
+                fd,
                 mtp_database,
-                false, 
-                userdata->pw_gid, 
-                FileSystemConfig::file_perm, 
+                false,
+                userdata->pw_gid,
+                FileSystemConfig::file_perm,
                 FileSystemConfig::directory_perm);
 
         // security / screen locking
@@ -302,12 +304,12 @@
         property_get ("ro.product.model", product_name, "Ubuntu Touch device");
 
         home_storage = new MtpStorage(
-            MTP_STORAGE_FIXED_RAM, 
+            MTP_STORAGE_FIXED_RAM,
             userdata->pw_dir,
 	    product_name,
             1024 * 1024 * 100,  /* 100 MB reserved space, to avoid filling the disk */
             false,
-            1024 * 1024 * 1024 * 2  /* 2GB arbitrary max file size */);
+            0  /* Do not check sizes for internal storage */);
         mtp_database->addStoragePath(std::string(userdata->pw_dir) + "/Documents",
                                      gettext("Documents"),
                                      MTP_STORAGE_FIXED_RAM, false);
@@ -424,7 +426,7 @@
         LOG(ERROR) << "Error opening /dev/mtp_usb, aborting now...";
         return 1;
     }
- 
+
     try {
         MtpDaemon *d = new MtpDaemon(fd);
 
 
=== modified file 'src/MtpDataPacket.cpp'
--- src/MtpDataPacket.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpDataPacket.cpp	2016-04-12 16:15:02 +0000
@@ -53,104 +53,178 @@
     MtpPacket::putUInt32(MTP_CONTAINER_TRANSACTION_ID_OFFSET, id);
 }
 
-uint16_t MtpDataPacket::getUInt16() {
-    int offset = mOffset;
-    uint16_t result = (uint16_t)mBuffer[offset] | ((uint16_t)mBuffer[offset + 1] << 8);
-    mOffset += 2;
-    return result;
-}
-
-uint32_t MtpDataPacket::getUInt32() {
-    int offset = mOffset;
-    uint32_t result = (uint32_t)mBuffer[offset] | ((uint32_t)mBuffer[offset + 1] << 8) |
+bool MtpDataPacket::getUInt8(uint8_t& value) {
+    if (mPacketSize - mOffset < sizeof(value))
+        return false;
+    value = mBuffer[mOffset++];
+    return true;
+}
+
+bool MtpDataPacket::getUInt16(uint16_t& value) {
+    if (mPacketSize - mOffset < sizeof(value))
+        return false;
+    size_t offset = mOffset;
+    value = (uint16_t)mBuffer[offset] | ((uint16_t)mBuffer[offset + 1] << 8);
+    mOffset += sizeof(value);
+    return true;
+}
+
+bool MtpDataPacket::getUInt32(uint32_t& value) {
+    if (mPacketSize - mOffset < sizeof(value))
+        return false;
+    size_t offset = mOffset;
+    value = (uint32_t)mBuffer[offset] | ((uint32_t)mBuffer[offset + 1] << 8) |
            ((uint32_t)mBuffer[offset + 2] << 16)  | ((uint32_t)mBuffer[offset + 3] << 24);
-    mOffset += 4;
-    return result;
+    mOffset += sizeof(value);
+    return true;
 }
 
-uint64_t MtpDataPacket::getUInt64() {
-    int offset = mOffset;
-    uint64_t result = (uint64_t)mBuffer[offset] | ((uint64_t)mBuffer[offset + 1] << 8) |
+bool MtpDataPacket::getUInt64(uint64_t& value) {
+    if (mPacketSize - mOffset < sizeof(value))
+        return false;
+    size_t offset = mOffset;
+    value = (uint64_t)mBuffer[offset] | ((uint64_t)mBuffer[offset + 1] << 8) |
            ((uint64_t)mBuffer[offset + 2] << 16) | ((uint64_t)mBuffer[offset + 3] << 24) |
            ((uint64_t)mBuffer[offset + 4] << 32) | ((uint64_t)mBuffer[offset + 5] << 40) |
            ((uint64_t)mBuffer[offset + 6] << 48)  | ((uint64_t)mBuffer[offset + 7] << 56);
-    mOffset += 8;
-    return result;
-}
-
-void MtpDataPacket::getUInt128(uint128_t& value) {
-    value[0] = getUInt32();
-    value[1] = getUInt32();
-    value[2] = getUInt32();
-    value[3] = getUInt32();
-}
-
-void MtpDataPacket::getString(MtpStringBuffer& string)
+    mOffset += sizeof(value);
+    return true;
+}
+
+bool MtpDataPacket::getUInt128(uint128_t& value) {
+    return getUInt32(value[0]) && getUInt32(value[1]) && getUInt32(value[2]) && getUInt32(value[3]);
+}
+
+bool MtpDataPacket::getString(MtpStringBuffer& string)
 {
-    string.readFromPacket(this);
+    return string.readFromPacket(this);
 }
 
 Int8List* MtpDataPacket::getAInt8() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     Int8List* result = new Int8List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getInt8());
+    for (uint32_t i = 0; i < count; i++) {
+        int8_t value;
+        if (!getInt8(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 UInt8List* MtpDataPacket::getAUInt8() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     UInt8List* result = new UInt8List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getUInt8());
+    for (uint32_t i = 0; i < count; i++) {
+        uint8_t value;
+        if (!getUInt8(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 Int16List* MtpDataPacket::getAInt16() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     Int16List* result = new Int16List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getInt16());
+    for (uint32_t i = 0; i < count; i++) {
+        int16_t value;
+        if (!getInt16(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 UInt16List* MtpDataPacket::getAUInt16() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     UInt16List* result = new UInt16List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getUInt16());
+    for (uint32_t i = 0; i < count; i++) {
+        uint16_t value;
+        if (!getUInt16(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 Int32List* MtpDataPacket::getAInt32() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     Int32List* result = new Int32List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getInt32());
+    for (uint32_t i = 0; i < count; i++) {
+        int32_t value;
+        if (!getInt32(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 UInt32List* MtpDataPacket::getAUInt32() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     UInt32List* result = new UInt32List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getUInt32());
+    for (uint32_t i = 0; i < count; i++) {
+        uint32_t value;
+        if (!getUInt32(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 Int64List* MtpDataPacket::getAInt64() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     Int64List* result = new Int64List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getInt64());
+    for (uint32_t i = 0; i < count; i++) {
+        int64_t value;
+        if (!getInt64(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
 UInt64List* MtpDataPacket::getAUInt64() {
+    uint32_t count;
+    if (!getUInt32(count))
+        return NULL;
     UInt64List* result = new UInt64List;
-    int count = getUInt32();
-    for (int i = 0; i < count; i++)
-        result->push_back(getUInt64());
+    for (uint32_t i = 0; i < count; i++) {
+        uint64_t value;
+        if (!getUInt64(value)) {
+            delete result;
+            return NULL;
+        }
+        result->push_back(value);
+    }
     return result;
 }
 
@@ -333,7 +407,7 @@
 
 void MtpDataPacket::putString(const uint16_t* string) {
     int count = 0;
-    for (int i = 0; i < 256; i++) {
+    for (int i = 0; i <= MTP_STRING_MAX_CHARACTER_NUMBER; i++) {
         if (string[i])
             count++;
         else
@@ -365,7 +439,7 @@
 }
 
 int MtpDataPacket::writeData(int fd, void* data, uint32_t length) {
-    allocate(length);
+    allocate(length + MTP_CONTAINER_HEADER_SIZE);
     memcpy(mBuffer + MTP_CONTAINER_HEADER_SIZE, data, length);
     length += MTP_CONTAINER_HEADER_SIZE;
     MtpPacket::putUInt32(MTP_CONTAINER_LENGTH_OFFSET, length);
@@ -420,7 +494,7 @@
 // Queue a read request.  Call readDataWait to wait for result
 int MtpDataPacket::readDataAsync(struct usb_request *req) {
     if (usb_request_queue(req)) {
-        PLOG(ERROR) << "usb_endpoint_queue failed";
+        PLOG(ERROR) << "usb_endpoint_queue failed, errno: " << errno;
         return -1;
     }
     return 0;
 
=== modified file 'src/MtpDevice.cpp'
--- src/MtpDevice.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpDevice.cpp	2016-04-12 16:15:02 +0000
@@ -135,13 +135,22 @@
             struct usb_endpoint_descriptor *ep_in_desc = NULL;
             struct usb_endpoint_descriptor *ep_out_desc = NULL;
             struct usb_endpoint_descriptor *ep_intr_desc = NULL;
+            //USB3 add USB_DT_SS_ENDPOINT_COMP as companion descriptor;
+            struct usb_ss_ep_comp_descriptor *ep_ss_ep_comp_desc = NULL;
             for (int i = 0; i < 3; i++) {
                 ep = (struct usb_endpoint_descriptor *)usb_descriptor_iter_next(&iter);
+                if (ep && ep->bDescriptorType == USB_DT_SS_ENDPOINT_COMP) {
+                    VLOG(2) << "Descriptor type is USB_DT_SS_ENDPOINT_COMP for USB3 \n";
+                    ep_ss_ep_comp_desc = (usb_ss_ep_comp_descriptor*)ep;
+                    ep = (struct usb_endpoint_descriptor *)usb_descriptor_iter_next(&iter);
+                 }
+
                 if (!ep || ep->bDescriptorType != USB_DT_ENDPOINT) {
                     LOG(ERROR) << "endpoints not found";
                     usb_device_close(device);
                     return NULL;
                 }
+
                 if (ep->bmAttributes == USB_ENDPOINT_XFER_BULK) {
                     if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
                         ep_in_desc = ep;
@@ -199,7 +208,7 @@
 
 MtpDevice::~MtpDevice() {
     close();
-    for (int i = 0; i < mDeviceProperties.size(); i++)
+    for (size_t i = 0; i < mDeviceProperties.size(); i++)
         delete mDeviceProperties[i];
     usb_request_free(mRequestIn1);
     usb_request_free(mRequestIn2);
@@ -257,7 +266,7 @@
             VLOG(2) << "*** FORMAT: " << MtpDebug::getFormatCodeName(format);
             MtpObjectPropertyList* props = getObjectPropsSupported(format);
             if (props) {
-                for (int j = 0; j < props->size(); j++) {
+                for (size_t j = 0; j < props->size(); j++) {
                     MtpObjectProperty prop = (*props)[j];
                     MtpProperty* property = getObjectPropDesc(prop, format);
                     if (property) {
@@ -317,8 +326,10 @@
     MtpResponseCode ret = readResponse();
     if (ret == MTP_RESPONSE_OK) {
         MtpDeviceInfo* info = new MtpDeviceInfo;
-        info->read(mData);
-        return info;
+        if (info->read(mData))
+            return info;
+        else
+            delete info;
     }
     return NULL;
 }
@@ -350,8 +361,10 @@
     MtpResponseCode ret = readResponse();
     if (ret == MTP_RESPONSE_OK) {
         MtpStorageInfo* info = new MtpStorageInfo(storageID);
-        info->read(mData);
-        return info;
+        if (info->read(mData))
+            return info;
+        else
+            delete info;
     }
     return NULL;
 }
@@ -389,8 +402,10 @@
     MtpResponseCode ret = readResponse();
     if (ret == MTP_RESPONSE_OK) {
         MtpObjectInfo* info = new MtpObjectInfo(handle);
-        info->read(mData);
-        return info;
+        if (info->read(mData))
+            return info;
+        else
+            delete info;
     }
     return NULL;
 }
@@ -551,8 +566,10 @@
     MtpResponseCode ret = readResponse();
     if (ret == MTP_RESPONSE_OK) {
         MtpProperty* property = new MtpProperty;
-        property->read(mData);
-        return property;
+        if (property->read(mData))
+            return property;
+        else
+            delete property;
     }
     return NULL;
 }
@@ -570,15 +587,17 @@
     MtpResponseCode ret = readResponse();
     if (ret == MTP_RESPONSE_OK) {
         MtpProperty* property = new MtpProperty;
-        property->read(mData);
-        return property;
+        if (property->read(mData))
+            return property;
+        else
+            delete property;
     }
     return NULL;
 }
 
 bool MtpDevice::readObject(MtpObjectHandle handle,
         bool (* callback)(void* data, int offset, int length, void* clientData),
-        int objectSize, void* clientData) {
+        size_t objectSize, void* clientData) {
     MtpAutolock autoLock(mMutex);
     bool result = false;
 
@@ -671,7 +690,7 @@
 // reads the object's data and writes it to the specified file path
 bool MtpDevice::readObject(MtpObjectHandle handle, const char* destPath, int group, int perm) {
     VLOG(2) << "readObject: " << destPath;
-    int fd = ::open(destPath, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
+    int fd = ::open(destPath, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE, S_IRUSR | S_IWUSR);
     if (fd < 0) {
         LOG(ERROR) << "open failed for " << destPath;
         return false;
 
=== modified file 'src/MtpDeviceInfo.cpp'
--- src/MtpDeviceInfo.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpDeviceInfo.cpp	2016-04-12 16:15:02 +0000
@@ -32,7 +32,7 @@
         mVendorExtensionID(0),
         mVendorExtensionVersion(0),
         mVendorExtensionDesc(NULL),
-        mFunctionalCode(0),
+        mFunctionalMode(0),
         mOperations(NULL),
         mEvents(NULL),
         mDeviceProperties(NULL),
@@ -63,32 +63,39 @@
         free(mSerial);
 }
 
-void MtpDeviceInfo::read(MtpDataPacket& packet) {
+bool MtpDeviceInfo::read(MtpDataPacket& packet) {
     MtpStringBuffer string;
 
     // read the device info
-    mStandardVersion = packet.getUInt16();
-    mVendorExtensionID = packet.getUInt32();
-    mVendorExtensionVersion = packet.getUInt16();
+    if (!packet.getUInt16(mStandardVersion)) return false;
+    if (!packet.getUInt32(mVendorExtensionID)) return false;
+    if (!packet.getUInt16(mVendorExtensionVersion)) return false;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mVendorExtensionDesc = strdup((const char *)string);
 
-    mFunctionalCode = packet.getUInt16();
+    if (!packet.getUInt16(mFunctionalMode)) return false;
     mOperations = packet.getAUInt16();
+    if (!mOperations) return false;
     mEvents = packet.getAUInt16();
+    if (!mEvents) return false;
     mDeviceProperties = packet.getAUInt16();
+    if (!mDeviceProperties) return false;
     mCaptureFormats = packet.getAUInt16();
+    if (!mCaptureFormats) return false;
     mPlaybackFormats = packet.getAUInt16();
+    if (!mCaptureFormats) return false;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mManufacturer = strdup((const char *)string);
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mModel = strdup((const char *)string);
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mVersion = strdup((const char *)string);
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mSerial = strdup((const char *)string);
+
+    return true;
 }
 
 void MtpDeviceInfo::print() {
@@ -97,7 +104,7 @@
             << "\n\tmVendorExtensionID: " << mVendorExtensionID
             << "\n\tmVendorExtensionVersion: " << mVendorExtensionVersion
             << "\n\tmVendorExtensionDesc: " << mVendorExtensionDesc
-            << "\n\tmFunctionalCode: " << mFunctionalCode
+            << "\n\tmFunctionalCode: " << mFunctionalMode
             << "\n\tmManufacturer: " << mManufacturer
             << "\n\tmModel: " << mModel
             << "\n\tmVersion: " << mVersion
 
=== modified file 'src/MtpObjectInfo.cpp'
--- src/MtpObjectInfo.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpObjectInfo.cpp	2016-04-12 16:15:02 +0000
@@ -60,39 +60,41 @@
         free(mKeywords);
 }
 
-void MtpObjectInfo::read(MtpDataPacket& packet) {
+bool MtpObjectInfo::read(MtpDataPacket& packet) {
     MtpStringBuffer string;
     time_t time;
 
-    mStorageID = packet.getUInt32();
-    mFormat = packet.getUInt16();
-    mProtectionStatus = packet.getUInt16();
-    mCompressedSize = packet.getUInt32();
-    mThumbFormat = packet.getUInt16();
-    mThumbCompressedSize = packet.getUInt32();
-    mThumbPixWidth = packet.getUInt32();
-    mThumbPixHeight = packet.getUInt32();
-    mImagePixWidth = packet.getUInt32();
-    mImagePixHeight = packet.getUInt32();
-    mImagePixDepth = packet.getUInt32();
-    mParent = packet.getUInt32();
-    mAssociationType = packet.getUInt16();
-    mAssociationDesc = packet.getUInt32();
-    mSequenceNumber = packet.getUInt32();
+    if (!packet.getUInt32(mStorageID)) return false;
+    if (!packet.getUInt16(mFormat)) return false;
+    if (!packet.getUInt16(mProtectionStatus)) return false;
+    if (!packet.getUInt32(mCompressedSize)) return false;
+    if (!packet.getUInt16(mThumbFormat)) return false;
+    if (!packet.getUInt32(mThumbCompressedSize)) return false;
+    if (!packet.getUInt32(mThumbPixWidth)) return false;
+    if (!packet.getUInt32(mThumbPixHeight)) return false;
+    if (!packet.getUInt32(mImagePixWidth)) return false;
+    if (!packet.getUInt32(mImagePixHeight)) return false;
+    if (!packet.getUInt32(mImagePixDepth)) return false;
+    if (!packet.getUInt32(mParent)) return false;
+    if (!packet.getUInt16(mAssociationType)) return false;
+    if (!packet.getUInt32(mAssociationDesc)) return false;
+    if (!packet.getUInt32(mSequenceNumber)) return false;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mName = strdup((const char *)string);
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     if (parseDateTime((const char*)string, time))
         mDateCreated = time;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     if (parseDateTime((const char*)string, time))
         mDateModified = time;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mKeywords = strdup((const char *)string);
+
+    return true;
 }
 
 void MtpObjectInfo::print() {
 
=== modified file 'src/MtpPacket.cpp'
--- src/MtpPacket.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpPacket.cpp	2016-04-12 16:15:02 +0000
@@ -52,7 +52,7 @@
     memset(mBuffer, 0, mBufferSize);
 }
 
-void MtpPacket::allocate(int length) {
+void MtpPacket::allocate(size_t length) {
     if (length > mBufferSize) {
         int newLength = length + mAllocationIncrement;
         mBuffer = (uint8_t *)realloc(mBuffer, newLength);
 
=== modified file 'src/MtpProperty.cpp'
--- src/MtpProperty.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpProperty.cpp	2016-04-12 16:15:02 +0000
@@ -112,15 +112,15 @@
         free(mMinimumValue.str);
         free(mMaximumValue.str);
         if (mDefaultArrayValues) {
-            for (int i = 0; i < mDefaultArrayLength; i++)
+            for (uint32_t i = 0; i < mDefaultArrayLength; i++)
                 free(mDefaultArrayValues[i].str);
         }
         if (mCurrentArrayValues) {
-            for (int i = 0; i < mCurrentArrayLength; i++)
+            for (uint32_t i = 0; i < mCurrentArrayLength; i++)
                 free(mCurrentArrayValues[i].str);
         }
         if (mEnumValues) {
-            for (int i = 0; i < mEnumLength; i++)
+            for (uint16_t i = 0; i < mEnumLength; i++)
                 free(mEnumValues[i].str);
         }
     }
@@ -129,11 +129,14 @@
     delete[] mEnumValues;
 }
 
-void MtpProperty::read(MtpDataPacket& packet) {
-    mCode = packet.getUInt16();
+bool MtpProperty::read(MtpDataPacket& packet) {
+    uint8_t temp8;
+
+    if (!packet.getUInt16(mCode)) return false;
     bool deviceProp = isDeviceProperty();
-    mType = packet.getUInt16();
-    mWriteable = (packet.getUInt8() == 1);
+    if (!packet.getUInt16(mType)) return false;
+    if (!packet.getUInt8(temp8)) return false;
+    mWriteable = (temp8 == 1);
     switch (mType) {
         case MTP_TYPE_AINT8:
         case MTP_TYPE_AUINT8:
@@ -146,28 +149,36 @@
         case MTP_TYPE_AINT128:
         case MTP_TYPE_AUINT128:
             mDefaultArrayValues = readArrayValues(packet, mDefaultArrayLength);
-            if (deviceProp)
+            if (!mDefaultArrayValues) return false;
+            if (deviceProp) {
                 mCurrentArrayValues = readArrayValues(packet, mCurrentArrayLength);
+                if (!mCurrentArrayValues) return false;
+            }
             break;
         default:
-            readValue(packet, mDefaultValue);
-            if (deviceProp)
-                readValue(packet, mCurrentValue);
-    }
-    if (!deviceProp)
-        mGroupCode = packet.getUInt32();
-    mFormFlag = packet.getUInt8();
+            if (!readValue(packet, mDefaultValue)) return false;
+            if (deviceProp) {
+                if (!readValue(packet, mCurrentValue)) return false;
+            }
+    }
+    if (!deviceProp) {
+        if (!packet.getUInt32(mGroupCode)) return false;
+    }
+    if (!packet.getUInt8(mFormFlag)) return false;
 
     if (mFormFlag == kFormRange) {
-            readValue(packet, mMinimumValue);
-            readValue(packet, mMaximumValue);
-            readValue(packet, mStepSize);
+            if (!readValue(packet, mMinimumValue)) return false;
+            if (!readValue(packet, mMaximumValue)) return false;
+            if (!readValue(packet, mStepSize)) return false;
     } else if (mFormFlag == kFormEnum) {
-        mEnumLength = packet.getUInt16();
+        if (!packet.getUInt16(mEnumLength)) return false;
         mEnumValues = new MtpPropertyValue[mEnumLength];
-        for (int i = 0; i < mEnumLength; i++)
-            readValue(packet, mEnumValues[i]);
+        for (int i = 0; i < mEnumLength; i++) {
+            if (!readValue(packet, mEnumValues[i])) return false;
+        }
     }
+
+    return true;
 }
 
 void MtpProperty::write(MtpDataPacket& packet) {
@@ -197,9 +208,9 @@
             if (deviceProp)
                 writeValue(packet, mCurrentValue);
     }
-    packet.putUInt32(mGroupCode);
     if (!deviceProp)
-        packet.putUInt8(mFormFlag);
+        packet.putUInt32(mGroupCode);
+    packet.putUInt8(mFormFlag);
     if (mFormFlag == kFormRange) {
             writeValue(packet, mMinimumValue);
             writeValue(packet, mMaximumValue);
@@ -423,52 +434,52 @@
     buffer += ss.str();
 }
 
-void MtpProperty::readValue(MtpDataPacket& packet, MtpPropertyValue& value) {
+bool MtpProperty::readValue(MtpDataPacket& packet, MtpPropertyValue& value) {
     MtpStringBuffer stringBuffer;
 
     switch (mType) {
         case MTP_TYPE_INT8:
         case MTP_TYPE_AINT8:
-            value.u.i8 = packet.getInt8();
+            if (!packet.getInt8(value.u.i8)) return false;
             break;
         case MTP_TYPE_UINT8:
         case MTP_TYPE_AUINT8:
-            value.u.u8 = packet.getUInt8();
+            if (!packet.getUInt8(value.u.u8)) return false;
             break;
         case MTP_TYPE_INT16:
         case MTP_TYPE_AINT16:
-            value.u.i16 = packet.getInt16();
+            if (!packet.getInt16(value.u.i16)) return false;
             break;
         case MTP_TYPE_UINT16:
         case MTP_TYPE_AUINT16:
-            value.u.u16 = packet.getUInt16();
+            if (!packet.getUInt16(value.u.u16)) return false;
             break;
         case MTP_TYPE_INT32:
         case MTP_TYPE_AINT32:
-            value.u.i32 = packet.getInt32();
+            if (!packet.getInt32(value.u.i32)) return false;
             break;
         case MTP_TYPE_UINT32:
         case MTP_TYPE_AUINT32:
-            value.u.u32 = packet.getUInt32();
+            if (!packet.getUInt32(value.u.u32)) return false;
             break;
         case MTP_TYPE_INT64:
         case MTP_TYPE_AINT64:
-            value.u.i64 = packet.getInt64();
+            if (!packet.getInt64(value.u.i64)) return false;
             break;
         case MTP_TYPE_UINT64:
         case MTP_TYPE_AUINT64:
-            value.u.u64 = packet.getUInt64();
+            if (!packet.getUInt64(value.u.u64)) return false;
             break;
         case MTP_TYPE_INT128:
         case MTP_TYPE_AINT128:
-            packet.getInt128(value.u.i128);
+            if (!packet.getInt128(value.u.i128)) return false;
             break;
         case MTP_TYPE_UINT128:
         case MTP_TYPE_AUINT128:
-            packet.getUInt128(value.u.u128);
+            if (!packet.getUInt128(value.u.u128)) return false;
             break;
         case MTP_TYPE_STR:
-            packet.getString(stringBuffer);
+            if (!packet.getString(stringBuffer)) return false;
             value.str = strdup(stringBuffer);
             break;
         default:
@@ -476,6 +487,7 @@
                        << std::hex << mType << std::dec
                        << " in MtpProperty::readValue";
     }
+    return true;
 }
 
 void MtpProperty::writeValue(MtpDataPacket& packet, MtpPropertyValue& value) {
@@ -535,19 +547,28 @@
     }
 }
 
-MtpPropertyValue* MtpProperty::readArrayValues(MtpDataPacket& packet, int& length) {
-    length = packet.getUInt32();
-    if (length == 0)
+MtpPropertyValue* MtpProperty::readArrayValues(MtpDataPacket& packet, uint32_t& length) {
+    if (!packet.getUInt32(length)) return NULL;
+
+    // Fail if resulting array is over 2GB.  This is because the maximum array
+    // size may be less than SIZE_MAX on some platforms.
+    if (length == 0 ||
+        length >= INT32_MAX / sizeof(MtpPropertyValue)) {
+        length = 0;
         return NULL;
+    }
     MtpPropertyValue* result = new MtpPropertyValue[length];
-    for (int i = 0; i < length; i++)
-        readValue(packet, result[i]);
+    for (uint32_t i = 0; i < length; i++)
+        if (!readValue(packet, result[i])) {
+            delete result;
+            return NULL;
+        }
     return result;
 }
 
-void MtpProperty::writeArrayValues(MtpDataPacket& packet, MtpPropertyValue* values, int length) {
+void MtpProperty::writeArrayValues(MtpDataPacket& packet, MtpPropertyValue* values, uint32_t length) {
     packet.putUInt32(length);
-    for (int i = 0; i < length; i++)
+    for (uint32_t i = 0; i < length; i++)
         writeValue(packet, values[i]);
 }
 
 
=== modified file 'src/MtpRequestPacket.cpp'
--- src/MtpRequestPacket.cpp	2013-06-13 10:22:21 +0000
+++ src/MtpRequestPacket.cpp	2016-04-12 16:15:02 +0000
@@ -24,11 +24,13 @@
 #include "MtpRequestPacket.h"
 
 #include <usbhost/usbhost.h>
+#include <glog/logging.h>
 
 namespace android {
 
 MtpRequestPacket::MtpRequestPacket()
-    :   MtpPacket(512)
+    :   MtpPacket(512),
+        mParameterCount(0)
 {
 }
 
@@ -38,10 +40,21 @@
 #ifdef MTP_DEVICE
 int MtpRequestPacket::read(int fd) {
     int ret = ::read(fd, mBuffer, mBufferSize);
-    if (ret >= 0)
+    if (ret < 0) {
+        // file read error
+        return ret;
+    }
+
+    // request packet should have 12 byte header followed by 0 to 5 32-bit arguments
+    if (ret >= MTP_CONTAINER_HEADER_SIZE
+            && ret <= MTP_CONTAINER_HEADER_SIZE + 5 * sizeof(uint32_t)
+            && ((ret - MTP_CONTAINER_HEADER_SIZE) & 3) == 0) {
         mPacketSize = ret;
-    else
-        mPacketSize = 0;
+        mParameterCount = (ret - MTP_CONTAINER_HEADER_SIZE) / sizeof(uint32_t);
+    } else {
+        PLOG(ERROR) << "Malformed MTP request packet";
+        ret = -1;
+    }
     return ret;
 }
 #endif
 
=== modified file 'src/MtpServer.cpp'
--- src/MtpServer.cpp	2014-10-31 15:56:55 +0000
+++ src/MtpServer.cpp	2016-04-12 16:15:02 +0000
@@ -27,6 +27,7 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include <unistd.h>
+#include <errno.h>
 
 #define LOG_TAG "MtpServer"
 
@@ -99,6 +100,7 @@
     MTP_EVENT_OBJECT_REMOVED,
     MTP_EVENT_STORE_ADDED,
     MTP_EVENT_STORE_REMOVED,
+    MTP_EVENT_DEVICE_PROP_CHANGED,
     MTP_EVENT_OBJECT_INFO_CHANGED,
     MTP_EVENT_OBJECT_PROP_CHANGED,
 };
@@ -132,7 +134,7 @@
 void MtpServer::removeStorage(MtpStorage* storage) {
     MtpAutolock autoLock(mMutex);
 
-    for (int i = 0; i < mStorages.size(); i++) {
+    for (size_t i = 0; i < mStorages.size(); i++) {
         if (mStorages[i] == storage) {
             mStorages.erase(mStorages.begin()+i);
             sendStoreRemoved(storage->getStorageID());
@@ -144,7 +146,7 @@
 MtpStorage* MtpServer::getStorage(MtpStorageID id) {
     if (id == 0)
         return mStorages[0];
-    for (int i = 0; i < mStorages.size(); i++) {
+    for (size_t i = 0; i < mStorages.size(); i++) {
         MtpStorage* storage = mStorages[i];
         if (storage->getStorageID() == id)
             return storage;
@@ -226,10 +228,12 @@
             VLOG(2) << "sending response "
                     << std::hex << mResponse.getResponseCode() << std::dec;
             ret = mResponse.write(fd);
+            const int savedErrno = errno;
             mResponse.dump();
             if (ret < 0) {
-                PLOG(ERROR) << "request write returned " << ret;
-                if (errno == ECANCELED) {
+                PLOG(ERROR) << "request write returned " << ret
+                            << ", errno: " << savedErrno;
+                if (savedErrno == ECANCELED) {
                     // return to top of loop and wait for next command
                     continue;
                 }
@@ -348,6 +352,15 @@
         mSendObjectHandle = kInvalidObjectHandle;
     }
 
+    int containertype = mRequest.getContainerType();
+    if (containertype != MTP_CONTAINER_TYPE_COMMAND) {
+        LOG(ERROR) << "wrong container type " << containertype;
+        return false;
+    }
+
+    VLOG(2) << "got command " << MtpDebug::getOperationCodeName(operation)
+            << ", " << std::hex << operation << std::dec;
+
     switch (operation) {
         case MTP_OPERATION_GET_DEVICE_INFO:
             response = doGetDeviceInfo();
@@ -513,6 +526,9 @@
         mResponse.setParameter(1, mSessionID);
         return MTP_RESPONSE_SESSION_ALREADY_OPEN;
     }
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
+
     mSessionID = mRequest.getParameter(1);
     mSessionOpen = true;
 
@@ -547,6 +563,9 @@
 
     if (!mSessionOpen)
         return MTP_RESPONSE_SESSION_NOT_OPEN;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
+
     MtpStorageID id = mRequest.getParameter(1);
     MtpStorage* storage = getStorage(id);
     if (!storage)
@@ -568,6 +587,8 @@
 MtpResponseCode MtpServer::doGetObjectPropsSupported() {
     if (!mSessionOpen)
         return MTP_RESPONSE_SESSION_NOT_OPEN;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectFormat format = mRequest.getParameter(1);
     MtpObjectPropertyList* properties = mDatabase->getSupportedObjectProperties(format);
     mData.putAUInt16(properties);
@@ -578,6 +599,8 @@
 MtpResponseCode MtpServer::doGetObjectHandles() {
     if (!mSessionOpen)
         return MTP_RESPONSE_SESSION_NOT_OPEN;
+    if (mRequest.getParameterCount() < 3)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpStorageID storageID = mRequest.getParameter(1);      // 0xFFFFFFFF for all storage
     MtpObjectFormat format = mRequest.getParameter(2);      // 0 for all formats
     MtpObjectHandle parent = mRequest.getParameter(3);      // 0xFFFFFFFF for objects with no parent
@@ -595,6 +618,8 @@
 MtpResponseCode MtpServer::doGetNumObjects() {
     if (!mSessionOpen)
         return MTP_RESPONSE_SESSION_NOT_OPEN;
+    if (mRequest.getParameterCount() < 3)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpStorageID storageID = mRequest.getParameter(1);      // 0xFFFFFFFF for all storage
     MtpObjectFormat format = mRequest.getParameter(2);      // 0 for all formats
     MtpObjectHandle parent = mRequest.getParameter(3);      // 0xFFFFFFFF for objects with no parent
@@ -617,6 +642,8 @@
         return MTP_RESPONSE_SESSION_NOT_OPEN;
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
 
     // FIXME - check for invalid object handle
@@ -635,9 +662,13 @@
         return MTP_RESPONSE_SESSION_NOT_OPEN;
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpStorageID handle = mRequest.getParameter(1);
 
     MtpObjectHandleList* references = mData.getAUInt32();
+    if (!references)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpResponseCode result = mDatabase->setObjectReferences(handle, references);
     delete references;
     return result;
@@ -646,6 +677,8 @@
 MtpResponseCode MtpServer::doGetObjectPropValue() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 2)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     MtpObjectProperty property = mRequest.getParameter(2);
     VLOG(2) << "GetObjectPropValue " << handle
@@ -659,6 +692,8 @@
 
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 2)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     MtpObjectProperty property = mRequest.getParameter(2);
     VLOG(2) << "SetObjectPropValue " << handle
@@ -672,6 +707,8 @@
 }
 
 MtpResponseCode MtpServer::doGetDevicePropValue() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpDeviceProperty property = mRequest.getParameter(1);
     VLOG(1) << "GetDevicePropValue " << MtpDebug::getDevicePropCodeName(property);
 
@@ -679,6 +716,8 @@
 }
 
 MtpResponseCode MtpServer::doSetDevicePropValue() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpDeviceProperty property = mRequest.getParameter(1);
     VLOG(1) << "SetDevicePropValue " << MtpDebug::getDevicePropCodeName(property);
 
@@ -686,6 +725,8 @@
 }
 
 MtpResponseCode MtpServer::doResetDevicePropValue() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpDeviceProperty property = mRequest.getParameter(1);
     VLOG(1) << "ResetDevicePropValue " << MtpDebug::getDevicePropCodeName(property);
 
@@ -695,6 +736,8 @@
 MtpResponseCode MtpServer::doGetObjectPropList() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 5)
+        return MTP_RESPONSE_INVALID_PARAMETER;
 
     MtpObjectHandle handle = mRequest.getParameter(1);
     // use uint32_t so we can support 0xFFFFFFFF
@@ -714,6 +757,8 @@
 MtpResponseCode MtpServer::doGetObjectInfo() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     MtpObjectInfo info(handle);
     MtpResponseCode result = mDatabase->getObjectInfo(handle, info);
@@ -754,6 +799,8 @@
 MtpResponseCode MtpServer::doGetObject() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     MtpString pathBuf;
     int64_t fileLength;
@@ -763,7 +810,7 @@
         return result;
 
     mtp_file_range  mfr;
-    mfr.fd = open(pathBuf.c_str(), O_RDONLY);
+    mfr.fd = open(pathBuf.c_str(), O_RDONLY | O_LARGEFILE);
     if (mfr.fd < 0) {
         return MTP_RESPONSE_GENERAL_ERROR;
     }
@@ -774,18 +821,24 @@
 
     // then transfer the file
     int ret = ioctl(mFD, MTP_SEND_FILE_WITH_HEADER, (unsigned long)&mfr);
+    if (ret < 0) {
+        if (errno == ECANCELED) {
+            result = MTP_RESPONSE_TRANSACTION_CANCELLED;
+        } else {
+            result = MTP_RESPONSE_GENERAL_ERROR;
+        }
+    } else {
+        result = MTP_RESPONSE_OK;
+    }
+
     VLOG(2) << "MTP_SEND_FILE_WITH_HEADER returned " << ret;
     close(mfr.fd);
-    if (ret < 0) {
-        if (errno == ECANCELED)
-            return MTP_RESPONSE_TRANSACTION_CANCELLED;
-        else
-            return MTP_RESPONSE_GENERAL_ERROR;
-    }
-    return MTP_RESPONSE_OK;
+    return result;
 }
 
 MtpResponseCode MtpServer::doGetThumb() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     size_t thumbSize;
     void* thumb = mDatabase->getThumbnail(handle, thumbSize);
@@ -809,11 +862,19 @@
     uint32_t length;
     offset = mRequest.getParameter(2);
     if (operation == MTP_OPERATION_GET_PARTIAL_OBJECT_64) {
+        // MTP_OPERATION_GET_PARTIAL_OBJECT_64 takes 4 arguments
+        if (mRequest.getParameterCount() < 4)
+            return MTP_RESPONSE_INVALID_PARAMETER;
+
         // android extension with 64 bit offset
         uint64_t offset2 = mRequest.getParameter(3);
         offset = offset | (offset2 << 32);
         length = mRequest.getParameter(4);
     } else {
+        // MTP_OPERATION_GET_PARTIAL_OBJECT takes 3 arguments
+        if (mRequest.getParameterCount() < 3)
+            return MTP_RESPONSE_INVALID_PARAMETER;
+
         // standard GetPartialObject
         length = mRequest.getParameter(3);
     }
@@ -823,11 +884,11 @@
     int result = mDatabase->getObjectFilePath(handle, pathBuf, fileLength, format);
     if (result != MTP_RESPONSE_OK)
         return result;
-    if (offset + length > fileLength)
+    if (offset + length > (uint64_t)fileLength)
         length = fileLength - offset;
 
     mtp_file_range  mfr;
-    mfr.fd = open(pathBuf.c_str(), O_RDONLY);
+    mfr.fd = open(pathBuf.c_str(), O_RDONLY | O_LARGEFILE);
     if (mfr.fd < 0) {
         return MTP_RESPONSE_GENERAL_ERROR;
     }
@@ -840,18 +901,24 @@
     // transfer the file
     int ret = ioctl(mFD, MTP_SEND_FILE_WITH_HEADER, (unsigned long)&mfr);
     VLOG(2) << "MTP_SEND_FILE_WITH_HEADER returned " << ret;
-    close(mfr.fd);
+    result = MTP_RESPONSE_OK;
     if (ret < 0) {
         if (errno == ECANCELED)
-            return MTP_RESPONSE_TRANSACTION_CANCELLED;
+            result = MTP_RESPONSE_TRANSACTION_CANCELLED;
         else
-            return MTP_RESPONSE_GENERAL_ERROR;
+            result = MTP_RESPONSE_GENERAL_ERROR;
     }
-    return MTP_RESPONSE_OK;
+    close(mfr.fd);
+    return result;
 }
 
 MtpResponseCode MtpServer::doSendObjectInfo() {
     MtpString path;
+    uint16_t temp16;
+    uint32_t temp32;
+
+    if (mRequest.getParameterCount() < 2)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpStorageID storageID = mRequest.getParameter(1);
     MtpStorage* storage = getStorage(storageID);
     MtpObjectHandle parent = mRequest.getParameter(2);
@@ -873,25 +940,29 @@
     }
 
     // read only the fields we need
-    mData.getUInt32();  // storage ID
-    MtpObjectFormat format = mData.getUInt16();
-    mData.getUInt16();  // protection status
-    mSendObjectFileSize = mData.getUInt32();
-    mData.getUInt16();  // thumb format
-    mData.getUInt32();  // thumb compressed size
-    mData.getUInt32();  // thumb pix width
-    mData.getUInt32();  // thumb pix height
-    mData.getUInt32();  // image pix width
-    mData.getUInt32();  // image pix height
-    mData.getUInt32();  // image bit depth
-    mData.getUInt32();  // parent
-    uint16_t associationType = mData.getUInt16();
-    uint32_t associationDesc = mData.getUInt32();   // association desc
-    mData.getUInt32();  // sequence number
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // storage ID
+    if (!mData.getUInt16(temp16)) return MTP_RESPONSE_INVALID_PARAMETER;
+    MtpObjectFormat format = temp16;
+    if (!mData.getUInt16(temp16)) return MTP_RESPONSE_INVALID_PARAMETER;  // protection status
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;
+    mSendObjectFileSize = temp32;
+    if (!mData.getUInt16(temp16)) return MTP_RESPONSE_INVALID_PARAMETER;  // thumb format
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // thumb compressed size
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // thumb pix width
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // thumb pix height
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // image pix width
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // image pix height
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // image bit depth
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // parent
+    if (!mData.getUInt16(temp16)) return MTP_RESPONSE_INVALID_PARAMETER;
+    uint16_t associationType = temp16;
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;
+    uint32_t associationDesc = temp32;        // association desc
+    if (!mData.getUInt32(temp32)) return MTP_RESPONSE_INVALID_PARAMETER;  // sequence number
     MtpStringBuffer name, created, modified;
-    mData.getString(name);    // file name
-    mData.getString(created);      // date created
-    mData.getString(modified);     // date modified
+    if (!mData.getString(name)) return MTP_RESPONSE_INVALID_PARAMETER;    // file name
+    if (!mData.getString(created)) return MTP_RESPONSE_INVALID_PARAMETER;      // date created
+    if (!mData.getString(modified)) return MTP_RESPONSE_INVALID_PARAMETER;     // date modified
     // keywords follow
 
     VLOG(2) << "name: " << (const char *) name
@@ -954,6 +1025,7 @@
     MtpResponseCode result = MTP_RESPONSE_OK;
     mode_t mask;
     int ret, initialData;
+    bool isCanceled = false;
 
     if (mSendObjectHandle == kInvalidObjectHandle) {
         LOG(ERROR) << "Expected SendObjectInfo before SendObject";
@@ -970,7 +1042,9 @@
     initialData = ret - MTP_CONTAINER_HEADER_SIZE;
 
     mtp_file_range  mfr;
-    mfr.fd = open(mSendObjectFilePath.c_str(), O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
+    mfr.fd = open(mSendObjectFilePath.c_str(),
+                  O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
+                  S_IRUSR | S_IWUSR);
     if (mfr.fd < 0) {
         result = MTP_RESPONSE_GENERAL_ERROR;
         goto done;
@@ -981,28 +1055,38 @@
     fchmod(mfr.fd, mFilePermission);
     umask(mask);
 
-    if (initialData > 0)
+    if (initialData > 0) {
         ret = write(mfr.fd, mData.getData(), initialData);
-
-    if (mSendObjectFileSize - initialData > 0) {
-        mfr.offset = initialData;
-        if (mSendObjectFileSize == 0xFFFFFFFF) {
-            // tell driver to read until it receives a short packet
-            mfr.length = 0xFFFFFFFF;
-        } else {
-            mfr.length = mSendObjectFileSize - initialData;
+    }
+
+    if (ret < 0) {
+        LOG(ERROR) << "failed to write initial data";
+        result = MTP_RESPONSE_GENERAL_ERROR;
+    } else {
+        if (mSendObjectFileSize - initialData > 0) {
+            mfr.offset = initialData;
+            if (mSendObjectFileSize == 0xFFFFFFFF) {
+                // tell driver to read until it receives a short packet
+                mfr.length = 0xFFFFFFFF;
+            } else {
+                mfr.length = mSendObjectFileSize - initialData;
+            }
+
+            VLOG(2) << "receiving " << mSendObjectFilePath.c_str();
+            // transfer the file
+            ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
+            if ((ret < 0) && (errno == ECANCELED)) {
+                isCanceled = true;
+            }
+
+            VLOG(2) << "MTP_RECEIVE_FILE returned " << ret;
         }
-
-        VLOG(2) << "receiving " << mSendObjectFilePath.c_str();
-        // transfer the file
-        ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
-        VLOG(2) << "MTP_RECEIVE_FILE returned " << ret;
     }
     close(mfr.fd);
 
     if (ret < 0) {
         unlink(mSendObjectFilePath.c_str());
-        if (errno == ECANCELED)
+        if (isCanceled)
             result = MTP_RESPONSE_TRANSACTION_CANCELLED;
         else
             result = MTP_RESPONSE_GENERAL_ERROR;
@@ -1021,7 +1105,7 @@
 
 static void deleteRecursive(const char* path) {
     char pathbuf[PATH_MAX];
-    int pathLength = strlen(path);
+    size_t pathLength = strlen(path);
     if (pathLength >= sizeof(pathbuf) - 1) {
         LOG(ERROR) << "path too long: " << path;
     }
@@ -1082,8 +1166,10 @@
 MtpResponseCode MtpServer::doDeleteObject() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
-    MtpObjectFormat format = mRequest.getParameter(2);
+    MtpObjectFormat format;
     // FIXME - support deleting all objects if handle is 0xFFFFFFFF
     // FIXME - implement deleting objects by format
 
@@ -1127,6 +1213,8 @@
 }
 
 MtpResponseCode MtpServer::doGetObjectPropDesc() {
+    if (mRequest.getParameterCount() < 2)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectProperty propCode = mRequest.getParameter(1);
     MtpObjectFormat format = mRequest.getParameter(2);
     VLOG(2) << "GetObjectPropDesc " << MtpDebug::getObjectPropCodeName(propCode)
@@ -1140,6 +1228,8 @@
 }
 
 MtpResponseCode MtpServer::doGetDevicePropDesc() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpDeviceProperty propCode = mRequest.getParameter(1);
     VLOG(1) << "GetDevicePropDesc " << MtpDebug::getDevicePropCodeName(propCode);
     MtpProperty* property = mDatabase->getDevicePropertyDesc(propCode);
@@ -1153,6 +1243,8 @@
 MtpResponseCode MtpServer::doSendPartialObject() {
     if (!hasStorage())
         return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+    if (mRequest.getParameterCount() < 4)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     uint64_t offset = mRequest.getParameter(2);
     uint64_t offset2 = mRequest.getParameter(3);
@@ -1188,19 +1280,27 @@
         length -= initialData;
     }
 
-    if (length > 0) {
-        mtp_file_range  mfr;
-        mfr.fd = edit->mFD;
-        mfr.offset = offset;
-        mfr.length = length;
+    bool isCanceled = false;
+    if (ret < 0) {
+        PLOG(ERROR) << "failed to write initial data";
+    } else {
+        if (length > 0) {
+            mtp_file_range  mfr;
+            mfr.fd = edit->mFD;
+            mfr.offset = offset;
+            mfr.length = length;
 
-        // transfer the file
-        ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
-        VLOG(2) << "MTP_RECEIVE_FILE returned " << ret;
+            // transfer the file
+            ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
+            if ((ret < 0) && (errno == ECANCELED)) {
+                isCanceled = true;
+            }
+            VLOG(2) << "MTP_RECEIVE_FILE returned " << ret << " errno " << errno;
+        }
     }
     if (ret < 0) {
         mResponse.setParameter(1, 0);
-        if (errno == ECANCELED)
+        if (isCanceled)
             return MTP_RESPONSE_TRANSACTION_CANCELLED;
         else
             return MTP_RESPONSE_GENERAL_ERROR;
@@ -1217,6 +1317,8 @@
 }
 
 MtpResponseCode MtpServer::doTruncateObject() {
+    if (mRequest.getParameterCount() < 3)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     ObjectEdit* edit = getEditObject(handle);
     if (!edit) {
@@ -1236,6 +1338,8 @@
 }
 
 MtpResponseCode MtpServer::doBeginEditObject() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     if (getEditObject(handle)) {
         LOG(ERROR) << "object already open for edit in doBeginEditObject";
@@ -1249,7 +1353,7 @@
     if (result != MTP_RESPONSE_OK)
         return result;
 
-    int fd = open(path.c_str(), O_RDWR | O_EXCL);
+    int fd = open(path.c_str(), O_RDWR | O_EXCL | O_LARGEFILE);
     if (fd < 0) {
         PLOG(ERROR) << "open failed for " << path.c_str() << " in doBeginEditObject";
         return MTP_RESPONSE_GENERAL_ERROR;
@@ -1260,6 +1364,8 @@
 }
 
 MtpResponseCode MtpServer::doEndEditObject() {
+    if (mRequest.getParameterCount() < 1)
+        return MTP_RESPONSE_INVALID_PARAMETER;
     MtpObjectHandle handle = mRequest.getParameter(1);
     ObjectEdit* edit = getEditObject(handle);
     if (!edit) {
 
=== modified file 'src/MtpStorageInfo.cpp'
--- src/MtpStorageInfo.cpp	2014-03-27 15:45:30 +0000
+++ src/MtpStorageInfo.cpp	2016-04-12 16:15:02 +0000
@@ -48,21 +48,23 @@
         free(mVolumeIdentifier);
 }
 
-void MtpStorageInfo::read(MtpDataPacket& packet) {
+bool MtpStorageInfo::read(MtpDataPacket& packet) {
     MtpStringBuffer string;
 
     // read the device info
-    mStorageType = packet.getUInt16();
-    mFileSystemType = packet.getUInt16();
-    mAccessCapability = packet.getUInt16();
-    mMaxCapacity = packet.getUInt64();
-    mFreeSpaceBytes = packet.getUInt64();
-    mFreeSpaceObjects = packet.getUInt32();
+    if (!packet.getUInt16(mStorageType)) return false;
+    if (!packet.getUInt16(mFileSystemType)) return false;
+    if (!packet.getUInt16(mAccessCapability)) return false;
+    if (!packet.getUInt64(mMaxCapacity)) return false;
+    if (!packet.getUInt64(mFreeSpaceBytes)) return false;
+    if (!packet.getUInt32(mFreeSpaceObjects)) return false;
 
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mStorageDescription = strdup((const char *)string);
-    packet.getString(string);
+    if (!packet.getString(string)) return false;
     mVolumeIdentifier = strdup((const char *)string);
+
+    return true;
 }
 
 void MtpStorageInfo::print() {
 
=== modified file 'src/MtpStringBuffer.cpp'
--- src/MtpStringBuffer.cpp	2013-06-13 10:22:21 +0000
+++ src/MtpStringBuffer.cpp	2016-04-12 16:15:02 +0000
@@ -56,42 +56,47 @@
 }
 
 void MtpStringBuffer::set(const char* src) {
-    int length = strlen(src);
-    if (length >= sizeof(mBuffer))
-        length = sizeof(mBuffer) - 1;
-    memcpy(mBuffer, src, length);
-
     // count the characters
     int count = 0;
     char ch;
-    while ((ch = *src++) != 0) {
+    char* dest = (char*)mBuffer;
+
+    while ((ch = *src++) != 0 && count < MTP_STRING_MAX_CHARACTER_NUMBER) {
         if ((ch & 0x80) == 0) {
             // single byte character
+            *dest++ = ch;
         } else if ((ch & 0xE0) == 0xC0) {
             // two byte character
-            if (! *src++) {
+            char ch1 = *src++;
+            if (! ch1) {
                 // last character was truncated, so ignore last byte
-                length--;
                 break;
             }
+
+            *dest++ = ch;
+            *dest++ = ch1;
         } else if ((ch & 0xF0) == 0xE0) {
             // 3 byte char
-            if (! *src++) {
-                // last character was truncated, so ignore last byte
-                length--;
-                break;
-            }
-            if (! *src++) {
-                // last character was truncated, so ignore last two bytes
-                length -= 2;
-                break;
-            }
+            char ch1 = *src++;
+            if (! ch1) {
+                // last character was truncated, so ignore last byte
+                break;
+            }
+            char ch2 = *src++;
+            if (! ch2) {
+                // last character was truncated, so ignore last byte
+                break;
+            }
+
+            *dest++ = ch;
+            *dest++ = ch1;
+            *dest++ = ch2;
         }
         count++;
     }
 
-    mByteCount = length + 1;
-    mBuffer[length] = 0;
+    *dest++ = 0;
+    mByteCount = dest - (char*)mBuffer;
     mCharCount = count;
 }
 
@@ -100,7 +105,7 @@
     uint16_t ch;
     uint8_t* dest = mBuffer;
 
-    while ((ch = *src++) != 0 && count < 255) {
+    while ((ch = *src++) != 0 && count < MTP_STRING_MAX_CHARACTER_NUMBER) {
         if (ch >= 0x0800) {
             *dest++ = (uint8_t)(0xE0 | (ch >> 12));
             *dest++ = (uint8_t)(0x80 | ((ch >> 6) & 0x3F));
@@ -118,11 +123,17 @@
     mByteCount = dest - mBuffer;
 }
 
-void MtpStringBuffer::readFromPacket(MtpDataPacket* packet) {
-    int count = packet->getUInt8();
+bool MtpStringBuffer::readFromPacket(MtpDataPacket* packet) {
+    uint8_t count;
+    if (!packet->getUInt8(count))
+        return false;
+
     uint8_t* dest = mBuffer;
     for (int i = 0; i < count; i++) {
-        uint16_t ch = packet->getUInt16();
+        uint16_t ch;
+
+        if (!packet->getUInt16(ch))
+            return false;
         if (ch >= 0x0800) {
             *dest++ = (uint8_t)(0xE0 | (ch >> 12));
             *dest++ = (uint8_t)(0x80 | ((ch >> 6) & 0x3F));
@@ -137,6 +148,7 @@
     *dest++ = 0;
     mCharCount = count;
     mByteCount = dest - mBuffer;
+    return true;
 }
 
 void MtpStringBuffer::writeToPacket(MtpDataPacket* packet) const {
 
=== modified file 'src/MtpUtils.cpp'
--- src/MtpUtils.cpp	2013-09-10 15:54:14 +0000
+++ src/MtpUtils.cpp	2016-04-12 16:15:02 +0000
@@ -19,7 +19,6 @@
 #include <stdio.h>
 #include <time.h>
 
-// #include <cutils/tztime.h>
 #include "MtpUtils.h"
 
 namespace android {
@@ -31,40 +30,40 @@
 DD replaced by the day (01-31), T is a constant character 'T' delimiting time from date,
 hh is replaced by the hour (00-23), mm is replaced by the minute (00-59), and ss by the
 second (00-59). The ".s" is optional, and represents tenths of a second.
+This is followed by a UTC offset given as "[+-]zzzz" or the literal "Z", meaning UTC.
 */
 
 bool parseDateTime(const char* dateTime, time_t& outSeconds) {
     int year, month, day, hour, minute, second;
-    struct tm tm;
-
     if (sscanf(dateTime, "%04d%02d%02dT%02d%02d%02d",
-            &year, &month, &day, &hour, &minute, &second) != 6)
+               &year, &month, &day, &hour, &minute, &second) != 6)
         return false;
+
+    // skip optional tenth of second
     const char* tail = dateTime + 15;
-    // skip optional tenth of second
-    if (tail[0] == '.' && tail[1])
-        tail += 2;
-    //FIXME - support +/-hhmm
+    if (tail[0] == '.' && tail[1]) tail += 2;
+
+    // FIXME: "Z" means UTC, but non-"Z" doesn't mean local time.
+    // It might be that you're in Asia/Seoul on vacation and your Android
+    // device has noticed this via the network, but your camera was set to
+    // America/Los_Angeles once when you bought it and doesn't know where
+    // it is right now, so the camera says "20160106T081700-0800" but we
+    // just ignore the "-0800" and assume local time which is actually "+0900".
+    // I think to support this (without switching to Java or using icu4c)
+    // you'd want to always use timegm(3) and then manually add/subtract
+    // the UTC offset parsed from the string (taking care of wrapping).
+    // mktime(3) ignores the tm_gmtoff field, so you can't let it do the work.
     bool useUTC = (tail[0] == 'Z');
 
-    // hack to compute timezone
-    time_t dummy;
-    tzset();
-    localtime_r(&dummy, &tm);
-
+    struct tm tm = {};
     tm.tm_sec = second;
     tm.tm_min = minute;
     tm.tm_hour = hour;
     tm.tm_mday = day;
     tm.tm_mon = month - 1;  // mktime uses months in 0 - 11 range
     tm.tm_year = year - 1900;
-    tm.tm_wday = 0;
     tm.tm_isdst = -1;
-    outSeconds = mktime(&tm);
-    /*if (useUTC)
-        outSeconds = mktime(&tm);
-    else
-        outSeconds = mktime_tz(&tm, tm.tm_zone);*/
+    outSeconds = useUTC ? timegm(&tm) : mktime(&tm);
 
     return true;
 }
@@ -74,7 +73,7 @@
 
     localtime_r(&seconds, &tm);
     snprintf(buffer, bufferLength, "%04d%02d%02dT%02d%02d%02d",
-        tm.tm_year + 1900, 
+        tm.tm_year + 1900,
         tm.tm_mon + 1, // localtime_r uses months in 0 - 11 range
         tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec);
 }
 
=== modified file 'tests/TestMtpUtils.cpp'
--- tests/TestMtpUtils.cpp	2013-09-13 14:21:51 +0000
+++ tests/TestMtpUtils.cpp	2016-04-12 16:15:02 +0000
@@ -40,7 +40,7 @@
 {
     time_t seconds = 1378726903;
     char buffer[25];
-    char *expected = "20130909T114143";
+    const char *expected = "20130909T114143";
 
     setenv("TZ", "UTC", 1);