commit de5c4c4671f63457151fce7b4ad7963518f8ce36
author Wei Jia <wjia@google.com> Tue Aug 18 16:33:38 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 16:33:38 2015 +0000
tree 73e9bdfee7dfcb46a5153179c59b2f407f9fb5ff
parent 9359e82213e6027b2390b76ba30e2e44f0d5cec6
parent 431312997856ce689e683ee0639cf1f4bedab7f0

am 43131299: am 1a09d352: Merge "libstagefright: check remaining data size before parsing it." into klp-dev

* commit '431312997856ce689e683ee0639cf1f4bedab7f0':
  libstagefright: check remaining data size before parsing it.

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index 894a9c9..a39aecf 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -509,6 +509,9 @@
         return;
     }
 
+    if (mFrameSize < getHeaderLength() + 1) {
+        return;
+    }
     size_t n = mFrameSize - getHeaderLength() - 1;
     if (otherdata) {
         // skip past the encoding, language, and the 0 separator