Commit 5eb714ea authored Jun 05, 2018 by Marco Nelissen Committed by Android (Google) Code Review Jun 05, 2018

Merge changes from topic "am-92cbb3f7-167f-4f57-b682-f916686fead9-mnc-dev" into cw-f-dev

* changes:
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a am: 1c7bb87a am: 4cdd5c3a am: bad0533d am: 19d1113b am: 8aeab2ca
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a am: 1c7bb87a am: 4cdd5c3a am: bad0533d am: 19d1113b
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a am: 1c7bb87a am: 4cdd5c3a am: bad0533d
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a am: 1c7bb87a am: 4cdd5c3a
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a am: 1c7bb87a
  [automerger] Fix possible out of bounds read am: 3762e061 am: ecc92a1a
  [automerger] Fix possible out of bounds read am: 3762e061
  Fix possible out of bounds read

parents e143e026 b04ca4cb

media/libstagefright/id3/ID3.cpp

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -603,6 +603,9 @@ void ID3::Iterator::getstring(String8 *id, bool otherdata) const {
	// UCS-2		// UCS-2
	// API wants number of characters, not number of bytes...		// API wants number of characters, not number of bytes...
	int len = n / 2;		int len = n / 2;
			if (len == 0) {
			return;
			}
	const char16_t framedata = (const char16_t ) (frameData + 1);		const char16_t framedata = (const char16_t ) (frameData + 1);
	char16_t *framedatacopy = NULL;		char16_t *framedatacopy = NULL;
	if (*framedata == 0xfffe) {		if (*framedata == 0xfffe) {