| commit | c81cdd3e8c53399a2902e49123dc9c7170082120 | [log] [tgz] |
|---|---|---|
| author | Roger1 Jonsson <roger1.jonsson@sonymobile.com> | Thu Sep 29 19:58:56 2016 +0000 |
| committer | android-build-merger <android-build-merger@google.com> | Thu Sep 29 19:58:56 2016 +0000 |
| tree | 653dc8b0f6be4e5c74c401089ad72380d506e87c | |
| parent | a5a70db55fe5c4f8ae2da08033a8b42691d5dec7 [diff] | |
| parent | 2e0151903d87ca62e9f18bf24dd3e86ac5fae5f2 [diff] |
Merge "Prevent crash for malformed ID3 COMM frame" am: 944706f468 am: 5c487ff344 am: 2e0151903d Change-Id: I7cf50f96b90c573d437becb478adce718a1d193b
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 3942158..aaf6b3d 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp
@@ -534,6 +534,9 @@ } size_t n = mFrameSize - getHeaderLength() - 1; if (otherdata) { + if (n < 5) { + return; + } // skip past the encoding, language, and the 0 separator frameData += 4; int32_t i = n - 4;