am 7b06f9ba: am fa11fd5b: resolved conflicts for merge of 327afffb to lmp-mr1-ub-dev (b3b34074) · Commits · e / os / android_frameworks_av

media/libstagefright/id3/ID3.cpp

+16 −1

Original line number	Diff line number	Diff line
		@@ -641,6 +641,11 @@ void ID3::Iterator::findFrame() {
		}
		mFrameSize += 6; // add tag id and size field

		// Prevent integer overflow in validation
		if (SIZE_MAX - mOffset <= mFrameSize) {
		return;
		}

		if (mOffset + mFrameSize > mParent.mSize) {
		ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)",
		mOffset, mFrameSize, mParent.mSize - mOffset - (size_t)6);
		@@ -670,7 +675,7 @@ void ID3::Iterator::findFrame() {
		return;
		}

		size_t baseSize;
		size_t baseSize = 0;
		if (mParent.mVersion == ID3_V2_4) {
		if (!ParseSyncsafeInteger(
		&mParent.mData[mOffset + 4], &baseSize)) {
		@@ -684,8 +689,18 @@ void ID3::Iterator::findFrame() {
		return;
		}

		// Prevent integer overflow when adding
		if (SIZE_MAX - 10 <= baseSize) {
		return;
		}

		mFrameSize = 10 + baseSize; // add tag id, size field and flags

		// Prevent integer overflow in validation
		if (SIZE_MAX - mOffset <= mFrameSize) {
		return;
		}

		if (mOffset + mFrameSize > mParent.mSize) {
		ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)",
		mOffset, mFrameSize, mParent.mSize - mOffset - (size_t)10);