Fix out of bounds access (d1c19c57) · Commits · e / os / android_frameworks_av

media/libstagefright/id3/ID3.cpp

+8 −4

Original line number	Diff line number	Diff line
		@@ -376,7 +376,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
		flags &= ~1;
		}

		if (flags & 2) {
		if ((flags & 2) && (dataSize >= 2)) {
		// This file has "unsynchronization", so we have to replace occurrences
		// of 0xff 0x00 with just 0xff in order to get the real data.

		@@ -392,11 +392,15 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
		mData[writeOffset++] = mData[readOffset++];
		}
		// move the remaining data following this frame
		if (readOffset <= oldSize) {
		memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);

		flags &= ~2;
		} else {
		ALOGE("b/34618607 (%zu %zu %zu %zu)", readOffset, writeOffset, oldSize, mSize);
		android_errorWriteLog(0x534e4554, "34618607");
		}

		}
		flags &= ~2;
		if (flags != prevFlags \|\| iTunesHack) {
		WriteSyncsafeInteger(&mData[offset + 4], dataSize);
		mData[offset + 8] = flags >> 8;