Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2ebc0b9 authored by Wei Jia's avatar Wei Jia
Browse files

libstagefright: check remaining data size before parsing it. 

Bug: 23248776
Change-Id: I45cf53e58e4375afcf260b122264c968ec0ff6c8
(cherry picked from commit 3bf1e0fd)
parent 120f259d

media/libstagefright/id3/ID3.cpp

+3 −0
Original line number Diff line number Diff line
@@ -550,6 +550,9 @@ void ID3::Iterator::getstring(String8 *id, bool otherdata) const { 
        return;

    }



    if (mFrameSize < getHeaderLength() + 1) {

        return;

    }

    size_t n = mFrameSize - getHeaderLength() - 1;

    if (otherdata) {

        // skip past the encoding, language, and the 0 separator