commit e9a8362e1d379e90655e904ca49d6333e4218eda
author Neel Mehta <nmehta@google.com> Tue Aug 18 16:33:48 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 16:33:48 2015 +0000
tree 06045d952b339d8891f04c94a25a9ff701aa83ce
parent 6afd8574d44ae158bed9cafe1c74dd1bfc5573b6
parent a2a6826494dec4a8fab6bd6828828fae886e516a

am a2a68264: am c37f7f6f: Fix for memory corruption in ID3::removeUnsynchronizationV2_4(). Bug: 23227354

* commit 'a2a6826494dec4a8fab6bd6828828fae886e516a':
  Fix for memory corruption in ID3::removeUnsynchronizationV2_4(). Bug: 23227354

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index a39aecf..fb3ae49 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -349,7 +349,7 @@
         if (flags & 1) {
             // Strip data length indicator
 
-            if (mSize < 14 || mSize - 14 < offset) {
+            if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
                 return false;
             }
             memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);