Code: bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
 size_t oldSize = mSize;

 size_t offset = 0;
 while (mSize >= 10 && offset <= mSize - 10) {
 if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
 break;
 }

 size_t dataSize;
 if (iTunesHack) {
            dataSize = U32_AT(&mData[offset + 4]);
 } else if (!ParseSyncsafeInteger(&mData[offset + 4], &dataSize)) {
 return false;
 }

 if (dataSize > mSize - 10 - offset) {
 return false;
 }

 uint16_t flags = U16_AT(&mData[offset + 8]);
 uint16_t prevFlags = flags;

 if (flags & 1) {

 if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
 return false;
 }
            memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
            mSize -= 4;
            dataSize -= 4;


             flags &= ~1;
         }
 
        if (flags & 2) {
 
 size_t readOffset = offset + 11;
 size_t writeOffset = offset + 11;
 for (size_t i = 0; i + 1 < dataSize; ++i) {
 if (mData[readOffset - 1] == 0xff
 && mData[readOffset] == 0x00) {
 ++readOffset;
 --mSize;
 --dataSize;
 }

                 mData[writeOffset++] = mData[readOffset++];
             }
            memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);
 
            flags &= ~2;
         }
         if (flags != prevFlags || iTunesHack) {
             WriteSyncsafeInteger(&mData[offset + 4], dataSize);
             mData[offset + 8] = flags >> 8;
            mData[offset + 9] = flags & 0xff;
 }

        offset += 10 + dataSize;
 }

    memset(&mData[mSize], 0, oldSize - mSize);

 return true;
}

Vulnerability Type: Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607.
Commit Message: Fix out of bounds access

Bug: 34618607
Change-Id: I84f0ef948414d0b2d54e8948b6c30b8ae4da2b36
(cherry picked from commit d1c19c57f66d91ea8033c8fa6510a8760a6e663b)
