diff --git a/src/android/org/linphone/ChatFragment.java b/src/android/org/linphone/ChatFragment.java
index cd1e68dbf..5b802c950 100644
--- a/src/android/org/linphone/ChatFragment.java
+++ b/src/android/org/linphone/ChatFragment.java
@@ -1101,7 +1101,7 @@ public class ChatFragment extends Fragment implements OnClickListener, ChatMessa
 			}
 			String fileName = path.substring(path.lastIndexOf("/") + 1);
 			String extension = LinphoneUtils.getExtensionFromFileName(fileName);
-			Content content = chatRoom.getCore().createContent(); // "image", extension, result, null
+			Content content = Factory.instance().createContent(); // "image", extension, result, null
 			content.setType("image");
 			content.setSubtype(extension);
 			content.setBuffer(result, result.length);
@@ -1158,7 +1158,7 @@ public class ChatFragment extends Fragment implements OnClickListener, ChatMessa
 
 			String fileName = path.substring(path.lastIndexOf("/") + 1);
 			String extension = LinphoneUtils.getExtensionFromFileName(fileName);
-			Content content = chatRoom.getCore().createContent();//"file", extension, result, null
+			Content content = Factory.instance().createContent();//"file", extension, result, null
 			content.setType("file");
 			content.setSubtype(extension);
 			content.setBuffer(result, result.length);
diff --git a/src/android/org/linphone/LinphoneManager.java b/src/android/org/linphone/LinphoneManager.java
index beb784a0f..1fd1d3528 100644
--- a/src/android/org/linphone/LinphoneManager.java
+++ b/src/android/org/linphone/LinphoneManager.java
@@ -460,6 +460,7 @@ public class LinphoneManager implements CoreListener, ChatMessageListener, Senso
 				}
 				bufferToFill.setContent(data, size);
 				bufferToFill.setSize(size);
+				return bufferToFill;
 			} else {
 				Log.e("Error, upload task asking for more bytes( " + (size+offset) + " ) than available (" + mUploadingImage.length + ")");
 			}
diff --git a/submodules/linphone b/submodules/linphone
index f1e0a4440..a9e3caf17 160000
--- a/submodules/linphone
+++ b/submodules/linphone
@@ -1 +1 @@
-Subproject commit f1e0a444018a655088057e84f078dc9ac90f4211
+Subproject commit a9e3caf17f8c233f5ab9a517a1382c6fd3453a24