commit 804c3b54a34be03ab576390797acc93607114225
author Sergio Giro <sgiro@google.com> Tue Jun 28 18:24:52 2016 +0100
committer Sergio Giro <sgiro@google.com> Thu Jul 14 14:47:01 2016 +0000
tree d19672c2cd35361234fdc14d4be4b2f7633399ef
parent 7a9538cd36716c8263d3808edd58bc87cedd8492

DO NOT MERGE Add bound checks to utf16_to_utf8

Bug: 29250543
(cherry picked from commit 1d3f4278b2666d1a145af2f54782c993aa07d1d9)

Change-Id: Id4ffb4bee02c3bd53796723b4cbcc88e693f8e83

media/libmediaplayerservice/MediaPlayerService.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index 8eb1269..fde317c 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -236,7 +236,8 @@
             // copying array size -1, array for tags was calloc'd, no need to NULL-terminate it
             size_t tagSize = realTagSize > AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 ?
                     AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 : realTagSize;
-            utf16_to_utf8(tags.string(), tagSize, attributes->tags);
+            utf16_to_utf8(tags.string(), tagSize, attributes->tags,
+                    sizeof(attributes->tags) / sizeof(attributes->tags[0]));
         }
     } else {
         ALOGE("unmarshallAudioAttributes() received unflattened tags, ignoring tag values");