Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 578d5b66 authored by Marco Nelissen's avatar Marco Nelissen Committed by Android Git Automerger
Browse files

am 171b5fad: am d6ea7f65: am f26400c9: Fix crash on malformed id3 

* commit '171b5fad':
  Fix crash on malformed id3
parents 660620d4 171b5fad

include/media/stagefright/MetaData.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -260,7 +260,7 @@ private: 
            return mSize <= sizeof(u.reservoir);

            return mSize <= sizeof(u.reservoir);

        }

        }





        void allocateStorage(size_t size);

        void *allocateStorage(size_t size);

        void freeStorage();

        void freeStorage();





        void *storage() {

        void *storage() {

media/libstagefright/MetaData.cpp

+20 −12
Original line number Original line Diff line number Diff line
@@ -244,8 +244,11 @@ MetaData::typed_data::~typed_data() { 
MetaData::typed_data::typed_data(const typed_data &from)

MetaData::typed_data::typed_data(const typed_data &from)

    : mType(from.mType),

    : mType(from.mType),

      mSize(0) {

      mSize(0) {

    allocateStorage(from.mSize);



    memcpy(storage(), from.storage(), mSize);

    void *dst = allocateStorage(from.mSize);

    if (dst) {

        memcpy(dst, from.storage(), mSize);

    }

}

}





MetaData::typed_data &MetaData::typed_data::operator=(

MetaData::typed_data &MetaData::typed_data::operator=(
@@ -253,8 +256,10 @@ MetaData::typed_data &MetaData::typed_data::operator=( 
    if (this != &from) {

    if (this != &from) {

        clear();

        clear();

        mType = from.mType;

        mType = from.mType;

        allocateStorage(from.mSize);

        void *dst = allocateStorage(from.mSize);

        memcpy(storage(), from.storage(), mSize);

        if (dst) {

            memcpy(dst, from.storage(), mSize);

        }

    }

    }





    return *this;

    return *this;
@@ -271,14 +276,12 @@ void MetaData::typed_data::setData( 
    clear();

    clear();





    mType = type;

    mType = type;

    allocateStorage(size);



    void *dst = storage();

    void *dst = allocateStorage(size);

    if (!dst) {

    if (dst) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        return;

    }

        memcpy(dst, data, size);

        memcpy(dst, data, size);

    }

    }

}





void MetaData::typed_data::getData(

void MetaData::typed_data::getData(

        uint32_t *type, const void **data, size_t *size) const {

        uint32_t *type, const void **data, size_t *size) const {
@@ -287,14 +290,19 @@ void MetaData::typed_data::getData( 
    *data = storage();

    *data = storage();

}

}





void MetaData::typed_data::allocateStorage(size_t size) {

void *MetaData::typed_data::allocateStorage(size_t size) {

    mSize = size;

    mSize = size;





    if (usesReservoir()) {

    if (usesReservoir()) {

        return;

        return &u.reservoir;

    }

    }





    u.ext_data = malloc(mSize);

    u.ext_data = malloc(mSize);

    if (u.ext_data == NULL) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        mSize = 0;

    }

    return u.ext_data;

}

}





void MetaData::typed_data::freeStorage() {

void MetaData::typed_data::freeStorage() {

media/libstagefright/id3/ID3.cpp

+6 −0
Original line number Original line Diff line number Diff line
@@ -804,6 +804,12 @@ ID3::getAlbumArt(size_t *length, String8 *mime) const { 




            size_t descLen = StringSize(&data[2 + mimeLen], encoding);

            size_t descLen = StringSize(&data[2 + mimeLen], encoding);





            if (size < 2 ||

                    size - 2 < mimeLen ||

                    size - 2 - mimeLen < descLen) {

                ALOGW("bogus album art sizes");

                return NULL;

            }

            *length = size - 2 - mimeLen - descLen;

            *length = size - 2 - mimeLen - descLen;





            return &data[2 + mimeLen + descLen];

            return &data[2 + mimeLen + descLen];