libstagefright: check remaining data size before parsing it.

Bug: 23248776 Change-Id: I45cf53e58e4375afcf260b122264c968ec0ff6c8 (cherry picked from commit 3bf1e0f)
android-security · Jun 7, 2016 · 8ab3245 · 8ab3245
1 parent fa16aa6
commit 8ab3245
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
@@ -547,6 +547,9 @@ void ID3::Iterator::getstring(String8 *id, bool otherdata) const {
         return;
     }
 
+    if (mFrameSize < getHeaderLength() + 1) {
+        return;
+    }
     size_t n = mFrameSize - getHeaderLength() - 1;
     if (otherdata) {
         // skip past the encoding, language, and the 0 separator