commit 450e1015b7939292ca988dd1b4f0303a094478e9
author Marco Nelissen <marcone@google.com> Thu Aug 06 08:03:47 2015 -0700
committer Marco Nelissen <marcone@google.com> Sat Aug 08 01:00:47 2015 +0000
tree 343e686f5c98dd7ade19045f82f0cfebfb2b353c
parent 2e637bfd64c59200414130671e32e3e087e9f147

Fix Ogg album art

Bug: 23036083
Bug: https://code.google.com/p/android/issues/detail?id=182053
Change-Id: I1a5cbe06990900160c2addade238c1e9feab8f71
(cherry picked from commit c63cc509404b9328aedd1be3adc4e87cd07b4eb1)

media/libstagefright/OggExtractor.cpp

diff --git a/media/libstagefright/OggExtractor.cpp b/media/libstagefright/OggExtractor.cpp
index 5e79e78..073c53f 100644
--- a/media/libstagefright/OggExtractor.cpp
+++ b/media/libstagefright/OggExtractor.cpp
@@ -923,11 +923,12 @@
     }
 
     typeLen = U32_AT(&flac[4]);
-    if (typeLen + 1 > sizeof(type)) {
+    if (typeLen > sizeof(type) - 1) {
         goto exit;
     }
 
-    if (flacSize < 8 + typeLen) {
+    // we've already checked above that flacSize >= 8
+    if (flacSize - 8 < typeLen) {
         goto exit;
     }
 
@@ -943,13 +944,17 @@
 
     descLen = U32_AT(&flac[8 + typeLen]);
 
-    if (flacSize < 32 + typeLen + descLen) {
+    if (flacSize < 32 ||
+        flacSize - 32 < typeLen ||
+        flacSize - 32 - typeLen < descLen) {
         goto exit;
     }
 
     dataLen = U32_AT(&flac[8 + typeLen + 4 + descLen + 16]);
 
-    if (flacSize < 32 + typeLen + descLen + dataLen) {
+
+    // we've already checked above that (flacSize - 32 - typeLen - descLen) >= 0
+    if (flacSize - 32 - typeLen - descLen < dataLen) {
         goto exit;
     }