commit 431312997856ce689e683ee0639cf1f4bedab7f0
author Wei Jia <wjia@google.com> Tue Aug 18 01:00:53 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 01:00:53 2015 +0000
tree 71c10c9a85888d7446f53d5a4c35b6056a94c380
parent 8a34499ab9987d962040881b4c8d66b655f65ae0
parent 1a09d3521e8849dcb1090ecb50393f6e9ee140ec

am 1a09d352: Merge "libstagefright: check remaining data size before parsing it." into klp-dev

* commit '1a09d3521e8849dcb1090ecb50393f6e9ee140ec':
  libstagefright: check remaining data size before parsing it.

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index fa37b40..2a139b3 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -550,6 +550,9 @@
         return;
     }
 
+    if (mFrameSize < getHeaderLength() + 1) {
+        return;
+    }
     size_t n = mFrameSize - getHeaderLength() - 1;
     if (otherdata) {
         // skip past the encoding, language, and the 0 separator