am 648ec9da: am 92b5c47a: am 32739430: am fbf55d85: am 80c17e0d: am 450e1015: Fix Ogg album art (f647c38a) · Commits · e / os / android_frameworks_av

media/libstagefright/OggExtractor.cpp

+9 −4

Original line number	Original line	Diff line number	Diff line
	@@ -973,11 +973,12 @@ static void extractAlbumArt(
	}		}

	typeLen = U32_AT(&flac[4]);		typeLen = U32_AT(&flac[4]);
	if (typeLen + 1 > sizeof(type)) {		if (typeLen > sizeof(type) - 1) {
	goto exit;		goto exit;
	}		}

	if (flacSize < 8 + typeLen) {		// we've already checked above that flacSize >= 8
			if (flacSize - 8 < typeLen) {
	goto exit;		goto exit;
	}		}

	@@ -993,13 +994,17 @@ static void extractAlbumArt(

	descLen = U32_AT(&flac[8 + typeLen]);		descLen = U32_AT(&flac[8 + typeLen]);

	if (flacSize < 32 + typeLen + descLen) {		if (flacSize < 32 \|\|
			flacSize - 32 < typeLen \|\|
			flacSize - 32 - typeLen < descLen) {
	goto exit;		goto exit;
	}		}

	dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);		dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);

	if (flacSize < 32 + typeLen + descLen + dataLen) {
			// we've already checked above that (flacSize - 32 - typeLen - descLen) >= 0
			if (flacSize - 32 - typeLen - descLen < dataLen) {
	goto exit;		goto exit;
	}		}