am 87f15e01: am 09da8691: libstagefright: fix possible overflow in ID3. (fb5d2674) · Commits · e / os / android_frameworks_av

media/libstagefright/id3/ID3.cpp

+5 −2

Original line number	Diff line number	Diff line
		@@ -327,7 +327,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
		size_t oldSize = mSize;

		size_t offset = 0;
		while (offset + 10 <= mSize) {
		while (mSize >= 10 && offset <= mSize - 10) {
		if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
		break;
		}
		@@ -339,7 +339,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
		return false;
		}

		if (offset + dataSize + 10 > mSize) {
		if (dataSize > mSize - 10 - offset) {
		return false;
		}

		@@ -349,6 +349,9 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
		if (flags & 1) {
		// Strip data length indicator

		if (mSize < 14 \|\| mSize - 14 < offset) {
		return false;
		}
		memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
		mSize -= 4;
		dataSize -= 4;