Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a3cc196 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "Fix out of bounds access" into klp-dev am: 360cbbd7 am: f71b76ca 

am: 36c2e14d

Change-Id: Ie6d46a6979bc89e2485fa4d2a25b21fc601e9783
parents 9fe1d609 36c2e14d

media/libstagefright/id3/ID3.cpp

+8 −4
Original line number Diff line number Diff line
@@ -379,7 +379,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { 
            flags &= ~1;

        }



        if (flags & 2) {

        if ((flags & 2) && (dataSize >= 2)) {

            // This file has "unsynchronization", so we have to replace occurrences

            // of 0xff 0x00 with just 0xff in order to get the real data.
@@ -395,11 +395,15 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { 
                mData[writeOffset++] = mData[readOffset++];

            }

            // move the remaining data following this frame

            if (readOffset <= oldSize) {

                memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);



            flags &= ~2;

            } else {

                ALOGE("b/34618607 (%zu %zu %zu %zu)", readOffset, writeOffset, oldSize, mSize);

                android_errorWriteLog(0x534e4554, "34618607");

            }



        }

        flags &= ~2;

        if (flags != prevFlags || iTunesHack) {

            WriteSyncsafeInteger(&mData[offset + 4], dataSize);

            mData[offset + 8] = flags >> 8;