diff options
| -rw-r--r-- | media/libstagefright/id3/ID3.cpp | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 112f136..581f4be 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -283,7 +283,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { size_t oldSize = mSize; size_t offset = 0; - while (offset + 10 <= mSize) { + while (mSize >= 10 && offset <= mSize - 10) { if (!memcmp(&mData[offset], "\0\0\0\0", 4)) { break; } @@ -295,7 +295,7 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { return false; } - if (offset + dataSize + 10 > mSize) { + if (dataSize > mSize - 10 - offset) { return false; } @@ -305,6 +305,9 @@ bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) { if (flags & 1) { // Strip data length indicator + if (mSize < 14 || mSize - 14 < offset) { + return false; + } memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14); mSize -= 4; dataSize -= 4; |