diff options
| author | Marco Nelissen <marcone@google.com> | 2015-01-15 22:27:38 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-01-15 22:27:38 +0000 |
| commit | 1509765f2262e4582cdcfdb064417884a3efa04c (patch) | |
| tree | c9ebca50938dd7ca3808fbf20bc28e7da5e5165e /media | |
| parent | c9123e9aec7d84b51e5e3863953bcbd05e754513 (diff) | |
| parent | e680491ef752256d0d0d39fc77cd7495e580adea (diff) | |
| download | frameworks_av-1509765f2262e4582cdcfdb064417884a3efa04c.zip frameworks_av-1509765f2262e4582cdcfdb064417884a3efa04c.tar.gz frameworks_av-1509765f2262e4582cdcfdb064417884a3efa04c.tar.bz2 | |
am e680491e: am 1efe46de: Merge "Fix id3 parser crash"
* commit 'e680491ef752256d0d0d39fc77cd7495e580adea':
Fix id3 parser crash
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/id3/ID3.cpp | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index d8bfada..d9491d6 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -630,7 +630,10 @@ void ID3::Iterator::findFrame() { | (mParent.mData[mOffset + 4] << 8) | mParent.mData[mOffset + 5]; - mFrameSize += 6; + if (mFrameSize == 0) { + return; + } + mFrameSize += 6; // add tag id and size field if (mOffset + mFrameSize > mParent.mSize) { ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)", @@ -671,7 +674,11 @@ void ID3::Iterator::findFrame() { baseSize = U32_AT(&mParent.mData[mOffset + 4]); } - mFrameSize = 10 + baseSize; + if (baseSize == 0) { + return; + } + + mFrameSize = 10 + baseSize; // add tag id, size field and flags if (mOffset + mFrameSize > mParent.mSize) { ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)", |