Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 450e1015 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix Ogg album art 

Bug: 23036083
Bug: https://code.google.com/p/android/issues/detail?id=182053
Change-Id: I1a5cbe06990900160c2addade238c1e9feab8f71
(cherry picked from commit c63cc509)
parent 2e637bfd

media/libstagefright/OggExtractor.cpp

+9 −4
Original line number Original line Diff line number Diff line
@@ -923,11 +923,12 @@ static void extractAlbumArt( 
    }

    }





    typeLen = U32_AT(&flac[4]);

    typeLen = U32_AT(&flac[4]);

    if (typeLen + 1 > sizeof(type)) {

    if (typeLen > sizeof(type) - 1) {

        goto exit;

        goto exit;

    }

    }





    if (flacSize < 8 + typeLen) {

    // we've already checked above that flacSize >= 8

    if (flacSize - 8 < typeLen) {

        goto exit;

        goto exit;

    }

    }
@@ -943,13 +944,17 @@ static void extractAlbumArt( 




    descLen = U32_AT(&flac[8 + typeLen]);

    descLen = U32_AT(&flac[8 + typeLen]);





    if (flacSize < 32 + typeLen + descLen) {

    if (flacSize < 32 ||

        flacSize - 32 < typeLen ||

        flacSize - 32 - typeLen < descLen) {

        goto exit;

        goto exit;

    }

    }





    dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);

    dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);





    if (flacSize < 32 + typeLen + descLen + dataLen) {



    // we've already checked above that (flacSize - 32 - typeLen - descLen) >= 0

    if (flacSize - 32 - typeLen - descLen < dataLen) {

        goto exit;

        goto exit;

    }

    }