commit 37d7af3c3a95022465b86b6cdec9db9fb5a40fd1
author Sergio Giro <sgiro@google.com> Tue Jun 28 18:24:52 2016 +0100
committer Sergio Giro <sgiro@google.com> Thu Jul 14 13:22:21 2016 +0000
tree b7d58e6a6c975599436e044a420ccd041b53ddf8
parent 786ddba2862716164920b455c4d5a1b3a7454193

Add bound checks to utf16_to_utf8

Bug: 29250543
Change-Id: I3518416e89ed901021970958fb6005fd69129f7c
(cherry picked from commit 1d3f4278b2666d1a145af2f54782c993aa07d1d9)

media/libmediaplayerservice/MediaPlayerService.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index acba6d7..32f86df 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -237,7 +237,8 @@
             // copying array size -1, array for tags was calloc'd, no need to NULL-terminate it
             size_t tagSize = realTagSize > AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 ?
                     AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 : realTagSize;
-            utf16_to_utf8(tags.string(), tagSize, attributes->tags);
+            utf16_to_utf8(tags.string(), tagSize, attributes->tags,
+                    sizeof(attributes->tags) / sizeof(attributes->tags[0]));
         }
     } else {
         ALOGE("unmarshallAudioAttributes() received unflattened tags, ignoring tag values");