diff options
| author | Yamit Mehta <ymehta@codeaurora.org> | 2015-07-12 13:19:13 +0530 |
|---|---|---|
| committer | Linux Build Service Account <lnxbuild@localhost> | 2015-10-06 03:24:18 -0600 |
| commit | 34205d1f5f98b01ece198f16ad55ff80ece31558 (patch) | |
| tree | 7b903d34b8c4b7556e8e8fd617d3a24529c8cadf /media/libstagefright/id3/ID3.cpp | |
| parent | 32986d09ad26539e2532e6394205b43a0486a990 (diff) | |
| download | frameworks_av-34205d1f5f98b01ece198f16ad55ff80ece31558.zip frameworks_av-34205d1f5f98b01ece198f16ad55ff80ece31558.tar.gz frameworks_av-34205d1f5f98b01ece198f16ad55ff80ece31558.tar.bz2 | |
stagefright: handle zero size field in ID3v2 header
Specific clip contains corrupt ID3v2 header where size field is zero. This
corner case isn't handled properly and leads to crash.
Change-Id: Ic7e97b9de84b0cb3ce3716db95ab05f8f0db336f
CRs-Fixed: 815025
Diffstat (limited to 'media/libstagefright/id3/ID3.cpp')
| -rw-r--r-- | media/libstagefright/id3/ID3.cpp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 00f87aa..d9a198d 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -486,8 +486,9 @@ void ID3::Iterator::getString(String8 *id, String8 *comment) const { void ID3::Iterator::getstring(String8 *id, bool otherdata) const { id->setTo(""); - const uint8_t *frameData = mFrameData; - if (frameData == NULL) { + size_t size; + const uint8_t *frameData = getData(&size); + if ((size == 0) || (frameData == NULL)) { return; } |