diff options
author | Wei Jia <wjia@google.com> | 2015-08-13 17:16:09 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-13 17:16:09 +0000 |
commit | 59a385e41be35b25422bbdf27ba5f3f894081671 (patch) | |
tree | 07444ef594805aa8e3a4b8ca878d7626e59e5fe4 /media/libstagefright/id3 | |
parent | b07c4a8d7f6c0ce52e5c63142e39e8c39fcaee35 (diff) | |
parent | f66b81e7c05f62105e7a8deefeaf395b28cb4bb3 (diff) | |
download | frameworks_av-59a385e41be35b25422bbdf27ba5f3f894081671.zip frameworks_av-59a385e41be35b25422bbdf27ba5f3f894081671.tar.gz frameworks_av-59a385e41be35b25422bbdf27ba5f3f894081671.tar.bz2 |
am f66b81e7: am f22da1cf: am d7146ce7: am 3bb658ac: am 4e86a483: am f51115bd: libstagefright: fix possible overflow in ID3.
* commit 'f66b81e7c05f62105e7a8deefeaf395b28cb4bb3':
libstagefright: fix possible overflow in ID3.
Diffstat (limited to 'media/libstagefright/id3')
-rw-r--r-- | media/libstagefright/id3/ID3.cpp | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 38ba844..a90d958 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -327,7 +327,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { size_t oldSize = mSize; size_t offset = 0; - while (offset + 10 <= mSize) { + while (mSize >= 10 && offset <= mSize - 10) { if (!memcmp(&mData[offset], "\0\0\0\0", 4)) { break; } @@ -339,7 +339,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { return false; } - if (offset + dataSize + 10 > mSize) { + if (dataSize > mSize - 10 - offset) { return false; } @@ -349,6 +349,9 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { if (flags & 1) { // Strip data length indicator + if (mSize < 14 || mSize - 14 < offset) { + return false; + } memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14); mSize -= 4; dataSize -= 4; |