| commit | 5c487ff344861f34de9b226bd5b14f323ceb0ef7 | [log] [tgz] |
|---|---|---|
| author | Roger1 Jonsson <roger1.jonsson@sonymobile.com> | Thu Sep 29 19:44:28 2016 +0000 |
| committer | android-build-merger <android-build-merger@google.com> | Thu Sep 29 19:44:28 2016 +0000 |
| tree | aea89c635287e09759bb9fd89f0b62a5ab78d04c | |
| parent | c84b665cb474750e8b031a4bf6d34d0a3f3ed405 [diff] | |
| parent | 944706f46860c85ffd2b2d27d83072b24640d851 [diff] |
Merge "Prevent crash for malformed ID3 COMM frame" am: 944706f468 Change-Id: I73e84de9a7f3d9ce5a1bbfbf99bd21c610662c4c
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 35691b9..86b668c 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp
@@ -531,6 +531,9 @@ } size_t n = mFrameSize - getHeaderLength() - 1; if (otherdata) { + if (n < 5) { + return; + } // skip past the encoding, language, and the 0 separator frameData += 4; int32_t i = n - 4;