Code: static size_t StringSize(const uint8_t *start, uint8_t encoding) {
//// return includes terminator;  if unterminated, returns > limit
     if (encoding == 0x00 || encoding == 0x03) {
        return strlen((const char *)start) + 1;
     }
 
     size_t n = 0;
    while (start[n] != '\0' || start[n + 1] != '\0') {
         n += 2;
     }
    return n + 2;
 }

Commit Message: DO NOT MERGE: defensive parsing of mp3 album art information

several points in stagefrights mp3 album art code
used strlen() to parse user-supplied strings that may be
unterminated, resulting in reading beyond the end of a buffer.

This changes the code to use strnlen() for 8-bit encodings and
strengthens the parsing of 16-bit encodings similarly. It also
reworks how we watch for the end-of-buffer to avoid all over-reads.

Bug: 32377688
Test: crafted mp3's w/ good/bad cover art. See what showed in play music
Change-Id: Ia9f526d71b21ef6a61acacf616b573753cd21df6
(cherry picked from commit fa0806b594e98f1aed3ebcfc6a801b4c0056f9eb)

CWE ID: CWE-200
static size_t StringSize(const uint8_t *start, uint8_t encoding) {
//// return includes terminator;  if unterminated, returns > limit
static size_t StringSize(const uint8_t *start, size_t limit, uint8_t encoding) {

     if (encoding == 0x00 || encoding == 0x03) {
        return strnlen((const char *)start, limit) + 1;
     }
 
     size_t n = 0;
    while ((n+1 < limit) && (start[n] != '\0' || start[n + 1] != '\0')) {
         n += 2;
     }
    n += 2;
    return n;
 }
