am 80c17e0d: am 450e1015: Fix Ogg album art (fbf55d85) · Commits · e / devices / smdk4412 / android_frameworks_av

media/libstagefright/OggExtractor.cpp

+9 −4

Original line number	Diff line number	Diff line
		@@ -927,11 +927,12 @@ static void extractAlbumArt(
		}

		typeLen = U32_AT(&flac[4]);
		if (typeLen + 1 > sizeof(type)) {
		if (typeLen > sizeof(type) - 1) {
		goto exit;
		}

		if (flacSize < 8 + typeLen) {
		// we've already checked above that flacSize >= 8
		if (flacSize - 8 < typeLen) {
		goto exit;
		}

		@@ -947,13 +948,17 @@ static void extractAlbumArt(

		descLen = U32_AT(&flac[8 + typeLen]);

		if (flacSize < 32 + typeLen + descLen) {
		if (flacSize < 32 \|\|
		flacSize - 32 < typeLen \|\|
		flacSize - 32 - typeLen < descLen) {
		goto exit;
		}

		dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);

		if (flacSize < 32 + typeLen + descLen + dataLen) {

		// we've already checked above that (flacSize - 32 - typeLen - descLen) >= 0
		if (flacSize - 32 - typeLen - descLen < dataLen) {
		goto exit;
		}