Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f26400c9 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix crash on malformed id3 

Bug: 22954006
Change-Id: I488cb1e2c69fc7043b6040481b30fa866000515d
parent d9a9a324

include/media/stagefright/MetaData.h

+1 −1
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ private: 
            return mSize <= sizeof(u.reservoir);

        }



        void allocateStorage(size_t size);

        void *allocateStorage(size_t size);

        void freeStorage();



        void *storage() {

media/libstagefright/MetaData.cpp

+20 −12
Original line number Diff line number Diff line
@@ -233,8 +233,11 @@ MetaData::typed_data::~typed_data() { 
MetaData::typed_data::typed_data(const typed_data &from)

    : mType(from.mType),

      mSize(0) {

    allocateStorage(from.mSize);

    memcpy(storage(), from.storage(), mSize);



    void *dst = allocateStorage(from.mSize);

    if (dst) {

        memcpy(dst, from.storage(), mSize);

    }

}



MetaData::typed_data &MetaData::typed_data::operator=(
@@ -242,8 +245,10 @@ MetaData::typed_data &MetaData::typed_data::operator=( 
    if (this != &from) {

        clear();

        mType = from.mType;

        allocateStorage(from.mSize);

        memcpy(storage(), from.storage(), mSize);

        void *dst = allocateStorage(from.mSize);

        if (dst) {

            memcpy(dst, from.storage(), mSize);

        }

    }



    return *this;
@@ -260,14 +265,12 @@ void MetaData::typed_data::setData( 
    clear();



    mType = type;

    allocateStorage(size);

    void *dst = storage();

    if (!dst) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        return;

    }



    void *dst = allocateStorage(size);

    if (dst) {

        memcpy(dst, data, size);

    }

}



void MetaData::typed_data::getData(

        uint32_t *type, const void **data, size_t *size) const {
@@ -276,14 +279,19 @@ void MetaData::typed_data::getData( 
    *data = storage();

}



void MetaData::typed_data::allocateStorage(size_t size) {

void *MetaData::typed_data::allocateStorage(size_t size) {

    mSize = size;



    if (usesReservoir()) {

        return;

        return &u.reservoir;

    }



    u.ext_data = malloc(mSize);

    if (u.ext_data == NULL) {

        ALOGE("Couldn't allocate %zu bytes for item", size);

        mSize = 0;

    }

    return u.ext_data;

}



void MetaData::typed_data::freeStorage() {

media/libstagefright/id3/ID3.cpp

+6 −0
Original line number Diff line number Diff line
@@ -825,6 +825,12 @@ ID3::getAlbumArt(size_t *length, String8 *mime) const { 


            size_t descLen = StringSize(&data[2 + mimeLen], encoding);



            if (size < 2 ||

                    size - 2 < mimeLen ||

                    size - 2 - mimeLen < descLen) {

                ALOGW("bogus album art sizes");

                return NULL;

            }

            *length = size - 2 - mimeLen - descLen;



            return &data[2 + mimeLen + descLen];