From 2b5bd800e3b3f2e85731f8bd7a7565bdac77610e Mon Sep 17 00:00:00 2001
From: olly <olly@google.com>
Date: Mon, 31 Jul 2017 07:53:08 -0700
Subject: [PATCH] Robustness fix for malformed ID3 metadata

Issue: #3116

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=163693235
---
 .../exoplayer2/metadata/id3/Id3Decoder.java   | 27 +++++++++++++------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/library/core/src/main/java/com/google/android/exoplayer2/metadata/id3/Id3Decoder.java b/library/core/src/main/java/com/google/android/exoplayer2/metadata/id3/Id3Decoder.java
index df3353fb18..0e4256be5c 100644
--- a/library/core/src/main/java/com/google/android/exoplayer2/metadata/id3/Id3Decoder.java
+++ b/library/core/src/main/java/com/google/android/exoplayer2/metadata/id3/Id3Decoder.java
@@ -483,13 +483,8 @@ public final class Id3Decoder implements MetadataDecoder {
     int ownerEndIndex = indexOfZeroByte(data, 0);
     String owner = new String(data, 0, ownerEndIndex, "ISO-8859-1");
 
-    byte[] privateData;
     int privateDataStartIndex = ownerEndIndex + 1;
-    if (privateDataStartIndex < data.length) {
-      privateData = Arrays.copyOfRange(data, privateDataStartIndex, data.length);
-    } else {
-      privateData = new byte[0];
-    }
+    byte[] privateData = copyOfRangeIfValid(data, privateDataStartIndex, data.length);
 
     return new PrivFrame(owner, privateData);
   }
@@ -516,7 +511,7 @@ public final class Id3Decoder implements MetadataDecoder {
         descriptionEndIndex - descriptionStartIndex, charset);
 
     int objectDataStartIndex = descriptionEndIndex + delimiterLength(encoding);
-    byte[] objectData = Arrays.copyOfRange(data, objectDataStartIndex, data.length);
+    byte[] objectData = copyOfRangeIfValid(data, objectDataStartIndex, data.length);
 
     return new GeobFrame(mimeType, filename, description, objectData);
   }
@@ -553,7 +548,7 @@ public final class Id3Decoder implements MetadataDecoder {
         descriptionEndIndex - descriptionStartIndex, charset);
 
     int pictureDataStartIndex = descriptionEndIndex + delimiterLength(encoding);
-    byte[] pictureData = Arrays.copyOfRange(data, pictureDataStartIndex, data.length);
+    byte[] pictureData = copyOfRangeIfValid(data, pictureDataStartIndex, data.length);
 
     return new ApicFrame(mimeType, description, pictureType, pictureData);
   }
@@ -749,6 +744,22 @@ public final class Id3Decoder implements MetadataDecoder {
         ? 1 : 2;
   }
 
+  /**
+   * Copies the specified range of an array, or returns a zero length array if the range is invalid.
+   *
+   * @param data The array from which to copy.
+   * @param from The start of the range to copy (inclusive).
+   * @param to The end of the range to copy (exclusive).
+   * @return The copied data, or a zero length array if the range is invalid.
+   */
+  private static byte[] copyOfRangeIfValid(byte[] data, int from, int to) {
+    if (to <= from) {
+      // Invalid or zero length range.
+      return new byte[0];
+    }
+    return Arrays.copyOfRange(data, from, data.length);
+  }
+
   private static final class Id3Header {
 
     private final int majorVersion;