Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6ea7f65 authored by Marco Nelissen's avatar Marco Nelissen Committed by Android Git Automerger
Browse files

am f26400c9: Fix crash on malformed id3 

* commit 'f26400c9':
  Fix crash on malformed id3
parents 42bd61d7 f26400c9

include/media/stagefright/MetaData.h

+1 −1
Original line number Diff line number Diff line
@@ -248,7 +248,7 @@ private: 
            return mSize <= sizeof(u.reservoir);

        }



        void allocateStorage(size_t size);

        void *allocateStorage(size_t size);

        void freeStorage();



        void *storage() {

media/libstagefright/MetaData.cpp

+20 −12
Original line number Diff line number Diff line
@@ -243,8 +243,11 @@ MetaData::typed_data::~typed_data() { 
MetaData::typed_data::typed_data(const typed_data &from)

    : mType(from.mType),

      mSize(0) {

    allocateStorage(from.mSize);

    memcpy(storage(), from.storage(), mSize);



    void *dst = allocateStorage(from.mSize);

    if (dst) {

        memcpy(dst, from.storage(), mSize);

    }

}



MetaData::typed_data &MetaData::typed_data::operator=(
@@ -252,8 +255,10 @@ MetaData::typed_data &MetaData::typed_data::operator=( 
    if (this != &from) {

        clear();

        mType = from.mType;

        allocateStorage(from.mSize);

        memcpy(storage(), from.storage(), mSize);

        void *dst = allocateStorage(from.mSize);

        if (dst) {

            memcpy(dst, from.storage(), mSize);

        }

    }



    return *this;
@@ -270,14 +275,12 @@ void MetaData::typed_data::setData( 
    clear();



    mType = type;

    allocateStorage(size);

    void *dst = storage();

    if (!dst) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        return;

    }



    void *dst = allocateStorage(size);

    if (dst) {

        memcpy(dst, data, size);

    }

}



void MetaData::typed_data::getData(

        uint32_t *type, const void **data, size_t *size) const {
@@ -286,14 +289,19 @@ void MetaData::typed_data::getData( 
    *data = storage();

}



void MetaData::typed_data::allocateStorage(size_t size) {

void *MetaData::typed_data::allocateStorage(size_t size) {

    mSize = size;



    if (usesReservoir()) {

        return;

        return &u.reservoir;

    }



    u.ext_data = malloc(mSize);

    if (u.ext_data == NULL) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        mSize = 0;

    }

    return u.ext_data;

}



void MetaData::typed_data::freeStorage() {

media/libstagefright/id3/ID3.cpp

+6 −0
Original line number Diff line number Diff line
@@ -825,6 +825,12 @@ ID3::getAlbumArt(size_t *length, String8 *mime) const { 


            size_t descLen = StringSize(&data[2 + mimeLen], encoding);



            if (size < 2 ||

                    size - 2 < mimeLen ||

                    size - 2 - mimeLen < descLen) {

                ALOGW("bogus album art sizes");

                return NULL;

            }

            *length = size - 2 - mimeLen - descLen;



            return &data[2 + mimeLen + descLen];