rust-mobile / ndk

Rust bindings to the Android NDK
Apache License 2.0
1.11k stars 110 forks source link

ndk/hardware_buffer: Don't call `assume_init()` before checking error #426

Closed MarijnS95 closed 1 year ago

MarijnS95 commented 1 year ago

We were unconditionally passing an assume_init() value to status_to_io_result(), which would only return that value back if there was no error. This is UB if the MaybeUninit was never written to, which is typically the case when an error is returned. Instead a .map(|()| ...assume_init()) should be used to ensure we only move the MaybeUninit into an initialized Rust value when the error code says it is okay to do so.

As this is the only place where a non-void (()) value was passed to status_to_io_result(), the value: T argument has been removed in favour of always returning () just like the BitmapError::from_status() and MediaError::from_status() APIs.