commit 9e9d4a2bfbfb06ef17e5631928f06d16fda2c3e6
author Marco Nelissen <marcone@google.com> Thu May 11 15:17:42 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu Jun 08 18:16:06 2017 +0000
tree a3ec184d5cc7a41addf1785cfed92d400c0c77d7
parent 34a012f012b6a35c6a9feec424e2b81f560197e9

Fix infinite recursion

Bug: 36725407
Test: decoded poc and other files with and without fix
Change-Id: I9e23b2dbf133321bb01ae47c39761e17e46bd846
(cherry picked from commit ede62341663cf356edb20e3d14424aec767ea66b)

arm-wt-22k/lib_src/eas_xmf.c

diff --git a/arm-wt-22k/lib_src/eas_xmf.c b/arm-wt-22k/lib_src/eas_xmf.c
index 830b6e5..169eb7e 100644
--- a/arm-wt-22k/lib_src/eas_xmf.c
+++ b/arm-wt-22k/lib_src/eas_xmf.c
@@ -27,6 +27,8 @@
  *----------------------------------------------------------------------------
 */
 
+#include <log/log.h>
+
 #include "eas_data.h"
 #include "eas_miditypes.h"
 #include "eas_parser.h"
@@ -649,6 +651,11 @@
         for ( ; numItems > 0; numItems--)
         {
             /* process this item */
+            if (offset <= nodeOffset) {
+                ALOGE("b/36725407: parser did not advance");
+                return EAS_ERROR_FILE_FORMAT;
+            }
+
             if ((result = XMF_ReadNode(hwInstData, pXMFData, offset, &length)) != EAS_SUCCESS)
                 return result;