commit 017ff33fd419c50734f775d5054e2cbea719700b
author Marco Nelissen <marcone@google.com> Fri Jun 01 10:48:25 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 20 00:17:14 2018 +0000
tree c01413e1269d4d8df3a8937b3c8ba856d6ba598c
parent c9909e5a980f941a5b72477755e09fb4dc57c478

Fix possible out of bounds read

Bug: 78656554
Test: manual
Change-Id: I677f827483dcc80afac57fd7ef6807e633542252
(cherry picked from commit 3762e0615273f25b059556d5b5f65102e9c55c35)

media/libstagefright/id3/ID3.cpp

diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index e897b67..a0bfd06 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -606,6 +606,9 @@
         // UCS-2
         // API wants number of characters, not number of bytes...
         int len = n / 2;
+        if (len == 0) {
+            return;
+        }
         const char16_t *framedata = (const char16_t *) (frameData + 1);
         char16_t *framedatacopy = NULL;
         if (*framedata == 0xfffe) {