| commit | 2e0151903d87ca62e9f18bf24dd3e86ac5fae5f2 | [log] [tgz] |
|---|---|---|
| author | Roger1 Jonsson <roger1.jonsson@sonymobile.com> | Thu Sep 29 19:48:57 2016 +0000 |
| committer | android-build-merger <android-build-merger@google.com> | Thu Sep 29 19:48:57 2016 +0000 |
| tree | 63480814a613d7d1fd4ad78149767826f4ccd25c | |
| parent | 2384bfcce80c4791f31ace3484b2ceea74644a99 [diff] | |
| parent | 5c487ff344861f34de9b226bd5b14f323ceb0ef7 [diff] |
Merge "Prevent crash for malformed ID3 COMM frame" am: 944706f468 am: 5c487ff344 Change-Id: I512b4df1b87f9be715896f418fd7618d3d234e82
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 3942158..aaf6b3d 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp
@@ -534,6 +534,9 @@ } size_t n = mFrameSize - getHeaderLength() - 1; if (otherdata) { + if (n < 5) { + return; + } // skip past the encoding, language, and the 0 separator frameData += 4; int32_t i = n - 4;