commit d8d966fef52fe6a236e8ffdd43604e0ceeb0fab3
author Sergio Giro <sgiro@google.com> Thu Jul 14 18:14:54 2016 +0000
committer android-build-merger <android-build-merger@google.com> Thu Jul 14 18:14:54 2016 +0000
tree 3e35ca130052498eccc53eac2f4f07c501ab5de5
parent f3c0ccf224e89e81e733a50e49f2c1cd372ff29a
parent c0a1a3187c30a9140fd2e0d185339be5966ae5d8

Add bound checks to utf16_to_utf8 am: 0c9742db80
am: c0a1a3187c

Change-Id: I050e58df0250e5d685b03c3e572bb756e9f997f0

media/libmediaplayerservice/MediaPlayerService.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index f0baf69..b5d1cdb 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -237,7 +237,8 @@
             // copying array size -1, array for tags was calloc'd, no need to NULL-terminate it
             size_t tagSize = realTagSize > AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 ?
                     AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 : realTagSize;
-            utf16_to_utf8(tags.string(), tagSize, attributes->tags);
+            utf16_to_utf8(tags.string(), tagSize, attributes->tags,
+                    sizeof(attributes->tags) / sizeof(attributes->tags[0]));
         }
     } else {
         ALOGE("unmarshallAudioAttributes() received unflattened tags, ignoring tag values");