commit 04140c8682edf1ec20313995ad9af9321c9d293b
author Neel Mehta <nmehta@google.com> Fri Aug 14 17:38:48 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 19:19:42 2015 -0700
tree d45f598b4728cf3c48ddfd14ead059bbb60d5ad6
parent 7a7100f487628f2b26748b7429fb6ecd7bcba7ef

Fix for memory corruption in ID3::removeUnsynchronizationV2_4().
Bug: 23227354

Change-Id: Iaa36cfda4fd84ca7e039f56086fd61b4118020db
(cherry picked from commit 77e23413a539df16503e356bd4df4a952f3abc47)

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index a39aecf..fb3ae49 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -349,7 +349,7 @@
         if (flags & 1) {
             // Strip data length indicator
 
-            if (mSize < 14 || mSize - 14 < offset) {
+            if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
                 return false;
             }
             memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);