Fix id3 parser crash (ba6e9826) · Commits · e / os / android_frameworks_av

media/libstagefright/id3/ID3.cpp

+9 −2

Original line number	Diff line number	Diff line
		@@ -630,7 +630,10 @@ void ID3::Iterator::findFrame() {
		\| (mParent.mData[mOffset + 4] << 8)
		\| mParent.mData[mOffset + 5];

		mFrameSize += 6;
		if (mFrameSize == 0) {
		return;
		}
		mFrameSize += 6; // add tag id and size field

		if (mOffset + mFrameSize > mParent.mSize) {
		ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)",
		@@ -671,7 +674,11 @@ void ID3::Iterator::findFrame() {
		baseSize = U32_AT(&mParent.mData[mOffset + 4]);
		}

		mFrameSize = 10 + baseSize;
		if (baseSize == 0) {
		return;
		}

		mFrameSize = 10 + baseSize; // add tag id, size field and flags

		if (mOffset + mFrameSize > mParent.mSize) {
		ALOGV("partial frame at offset %zu (size = %zu, bytes-remaining = %zu)",