Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f2b91f0 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "Fix out of bounds access" into klp-dev am: 360cbbd7 am: f71b76ca... 

Merge "Fix out of bounds access" into klp-dev am: 360cbbd7 am: f71b76ca am: 36c2e14d am: 8a3cc196 am: 5b0ca6a9
am: d270a899

Change-Id: I64b30e83c6825a83ff628477a58d607eded0ec7d
parents b1c01ac1 d270a899

media/libstagefright/id3/ID3.cpp

+8 −4
Original line number Original line Diff line number Diff line
@@ -379,7 +379,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { 
            flags &= ~1;

            flags &= ~1;

        }

        }





        if (flags & 2) {

        if ((flags & 2) && (dataSize >= 2)) {

            // This file has "unsynchronization", so we have to replace occurrences

            // This file has "unsynchronization", so we have to replace occurrences

            // of 0xff 0x00 with just 0xff in order to get the real data.

            // of 0xff 0x00 with just 0xff in order to get the real data.
@@ -395,11 +395,15 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { 
                mData[writeOffset++] = mData[readOffset++];

                mData[writeOffset++] = mData[readOffset++];

            }

            }

            // move the remaining data following this frame

            // move the remaining data following this frame

            if (readOffset <= oldSize) {

                memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);

                memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);



            } else {

            flags &= ~2;

                ALOGE("b/34618607 (%zu %zu %zu %zu)", readOffset, writeOffset, oldSize, mSize);

                android_errorWriteLog(0x534e4554, "34618607");

            }

            }





        }

        flags &= ~2;

        if (flags != prevFlags || iTunesHack) {

        if (flags != prevFlags || iTunesHack) {

            WriteSyncsafeInteger(&mData[offset + 4], dataSize);

            WriteSyncsafeInteger(&mData[offset + 4], dataSize);

            mData[offset + 8] = flags >> 8;

            mData[offset + 8] = flags >> 8;