diff options
| author | Andreas Huber <andih@google.com> | 2010-03-29 15:13:40 -0700 |
|---|---|---|
| committer | Andreas Huber <andih@google.com> | 2010-03-29 15:13:40 -0700 |
| commit | 65997f022fa3f557ba864ecc99a1aa33df54c2db (patch) | |
| tree | d229e48b1d0084b2f0f0bb48d91ad34638b0274f | |
| parent | fb8391bfe3f21d08add3b65ba08d4d097c2bfdb6 (diff) | |
| download | frameworks_av-65997f022fa3f557ba864ecc99a1aa33df54c2db.zip frameworks_av-65997f022fa3f557ba864ecc99a1aa33df54c2db.tar.gz frameworks_av-65997f022fa3f557ba864ecc99a1aa33df54c2db.tar.bz2 | |
Limit the total amount of ID3 metadata to something (un-)reasonable: 3MB.
Change-Id: I3f9bbcdd4f563bac27c4ccae58e4179656c264b6
related-to-bug: 1903971
| -rw-r--r-- | media/libstagefright/id3/ID3.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index b263238..d688e2c 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -28,6 +28,8 @@ namespace android { +static const size_t kMaxMetadataSize = 3 * 1024 * 1024; + ID3::ID3(const sp<DataSource> &source) : mIsValid(false), mData(NULL), @@ -111,6 +113,11 @@ bool ID3::parseV2(const sp<DataSource> &source) { size = (size << 7) | header.enc_size[i]; } + if (size > kMaxMetadataSize) { + LOGE("skipping huge ID3 metadata of size %d", size); + return false; + } + mData = (uint8_t *)malloc(size); if (mData == NULL) { |