am d7c2effc: Merge "Prevent integer underflows in ID3::Iterator" (3ad0357a) · Commits · e / os / android_frameworks_av

media/libstagefright/httplive/PlaylistFetcher.cpp

+3 −0

Original line number	Diff line number	Diff line
		@@ -1499,6 +1499,9 @@ status_t PlaylistFetcher::extractAndQueueAccessUnits(
		while (!it.done()) {
		size_t length;
		const uint8_t *data = it.getData(&length);
		if (!data) {
		return ERROR_MALFORMED;
		}

		static const char *kMatchName =
		"com.apple.streaming.transportStreamTimestamp";

+11 −0

Original line number	Diff line number	Diff line
		@@ -506,6 +506,9 @@ void ID3::Iterator::getstring(String8 *id, bool otherdata) const {
		return;
		}

		if (mFrameSize < getHeaderLength() + 1) {
		return;
		}
		size_t n = mFrameSize - getHeaderLength() - 1;
		if (otherdata) {
		// skip past the encoding, language, and the 0 separator
		@@ -595,6 +598,11 @@ const uint8_t ID3::Iterator::getData(size_t length) const {
		return NULL;
		}

		// Prevent integer underflow
		if (mFrameSize < getHeaderLength()) {
		return NULL;
		}

		*length = mFrameSize - getHeaderLength();

		return mFrameData;
		@@ -794,6 +802,9 @@ ID3::getAlbumArt(size_t length, String8 mime) const {
		while (!it.done()) {
		size_t size;
		const uint8_t *data = it.getData(&size);
		if (!data) {
		return NULL;
		}

		if (mVersion == ID3_V2_3 \|\| mVersion == ID3_V2_4) {
		uint8_t encoding = data[0];