Code: static size_t StringSize(const uint8_t *start, uint8_t encoding) {
//// return includes terminator;  if unterminated, returns > limit
     if (encoding == 0x00 || encoding == 0x03) {
        return strlen((const char *)start) + 1;
     }
 
     size_t n = 0;
    while (start[n] != '\0' || start[n + 1] != '\0') {
         n += 2;
     }
    return n + 2;
 }

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32377688.
Commit Message: DO NOT MERGE: defensive parsing of mp3 album art information

several points in stagefrights mp3 album art code
used strlen() to parse user-supplied strings that may be
unterminated, resulting in reading beyond the end of a buffer.

This changes the code to use strnlen() for 8-bit encodings and
strengthens the parsing of 16-bit encodings similarly. It also
reworks how we watch for the end-of-buffer to avoid all over-reads.

Bug: 32377688
Test: crafted mp3's w/ good/bad cover art. See what showed in play music
Change-Id: Ia9f526d71b21ef6a61acacf616b573753cd21df6
(cherry picked from commit fa0806b594e98f1aed3ebcfc6a801b4c0056f9eb)
