From c39173be3237be9f39d2b57bb38249126e183c53 Mon Sep 17 00:00:00 2001 From: niko Date: Mon, 20 Jul 2009 13:10:01 -0700 Subject: [PATCH] Fixed a bug in the parser. When we parse the metadata we check that there is enough data in the parcel by checking the byte availables and the size in the header. Since the size is in the header has been read, we should make sure than dataAvailable() >= size - 4 This bug was hidden by some test code which has been removed. --- media/java/android/media/Metadata.java | 5 +++-- .../unit/MediaPlayerMetadataParserTest.java | 7 +------ 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/media/java/android/media/Metadata.java b/media/java/android/media/Metadata.java index 9d3f00540a4a1..7618435078fbe 100644 --- a/media/java/android/media/Metadata.java +++ b/media/java/android/media/Metadata.java @@ -280,8 +280,9 @@ public class Metadata final int pin = parcel.dataPosition(); // to roll back in case of errors. final int size = parcel.readInt(); - if (parcel.dataAvail() < size || size < kMetaHeaderSize) { - Log.e(TAG, "Bad size " + size); + // Magic 4 below is for the int32 'size' just read. + if (parcel.dataAvail() + 4 < size || size < kMetaHeaderSize) { + Log.e(TAG, "Bad size " + size + " avail " + parcel.dataAvail() + " position " + pin); parcel.setDataPosition(pin); return false; } diff --git a/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java b/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java index 576dddd6cf3ae..637ebb8614209 100644 --- a/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java +++ b/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java @@ -56,15 +56,10 @@ public class MediaPlayerMetadataParserTest extends AndroidTestCase { assertEquals(0, mParcel.dataPosition()); } - // Check parsing of the parcel is successful. Before the - // invocation of the parser a token is inserted. When the parser - // returns, the parcel should be positioned at the token (check it - // does not read too much data). + // Check parsing of the parcel is successful. private void assertParse() throws Exception { - mParcel.writeInt(kToken); mParcel.setDataPosition(0); assertTrue(mMetadata.parse(mParcel)); - assertEquals(kToken, mParcel.readInt()); } // Write the number of bytes from the start of the parcel to the