Fixed a bug in the parser.

When we parse the metadata we check that there is enough data in the parcel by checking
 the byte availables and the size in the header.
Since the size is in the header has been read, we should make sure than dataAvailable() >= size - 4

This bug was hidden by some test code which has been removed.

2 files changed, 4 insertions, 8 deletions

diff --git a/media/java/android/media/Metadata.java b/media/java/android/media/Metadata.java
index 9d3f00540a4a..7618435078fb 100644
--- a/media/java/android/media/Metadata.java
+++ b/media/java/android/media/Metadata.java
@@ -280,8 +280,9 @@ public class Metadata
         final int pin = parcel.dataPosition();  // to roll back in case of errors.
         final int size = parcel.readInt();
 
-        if (parcel.dataAvail() < size || size < kMetaHeaderSize) {
-            Log.e(TAG, "Bad size " + size);
+        // Magic 4 below is for the int32 'size' just read.
+        if (parcel.dataAvail() + 4 < size || size < kMetaHeaderSize) {
+            Log.e(TAG, "Bad size " + size + " avail " + parcel.dataAvail() + " position " + pin);
             parcel.setDataPosition(pin);
             return false;
         }
diff --git a/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java b/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java
index 576dddd6cf3a..637ebb861420 100644
--- a/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java
+++ b/media/tests/MediaFrameworkTest/src/com/android/mediaframeworktest/unit/MediaPlayerMetadataParserTest.java
@@ -56,15 +56,10 @@ public class MediaPlayerMetadataParserTest extends AndroidTestCase {
         assertEquals(0, mParcel.dataPosition());
     }
 
-    // Check parsing of the parcel is successful. Before the
-    // invocation of the parser a token is inserted. When the parser
-    // returns, the parcel should be positioned at the token (check it
-    // does not read too much data).
+    // Check parsing of the parcel is successful.
     private void assertParse() throws Exception {
-        mParcel.writeInt(kToken);
         mParcel.setDataPosition(0);
         assertTrue(mMetadata.parse(mParcel));
-        assertEquals(kToken, mParcel.readInt());
     }
 
     // Write the number of bytes from the start of the parcel to the