commit cc5d25bbcd124ec3aa8a0e0366c518e7e5c26d0b
author Marco Nelissen <marcone@google.com> Tue Jun 05 21:39:01 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Jun 05 21:39:01 2018 +0000
tree b4452ae5e422a7a55d326487b9dd4b9bad2198b8
parent cc3897e95be5f055ba6e2f210f70c7d1e1ef6585
parent bad0533d2ea29feb710cb8195206a05bf187b69f

Merge changes from topic "am-92cbb3f7-167f-4f57-b682-f916686fead9-mnc-dev" into nyc-dev

* changes:
  [automerger] Fix possible out of bounds read am: 3762e06152 am: ecc92a1a86 am: 1c7bb87a42 am: 4cdd5c3af5
  [automerger] Fix possible out of bounds read am: 3762e06152 am: ecc92a1a86 am: 1c7bb87a42
  [automerger] Fix possible out of bounds read am: 3762e06152 am: ecc92a1a86
  [automerger] Fix possible out of bounds read am: 3762e06152
  Fix possible out of bounds read

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index 4e1cdf6..ca2be54 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -603,6 +603,9 @@
         // UCS-2
         // API wants number of characters, not number of bytes...
         int len = n / 2;
+        if (len == 0) {
+            return;
+        }
         const char16_t *framedata = (const char16_t *) (frameData + 1);
         char16_t *framedatacopy = NULL;
         if (*framedata == 0xfffe) {