GitLab

Bug: 23227354

Change-Id: Iaa36cfda4fd84ca7e039f56086fd61b4118020db
(cherry picked from commit 77e23413)

Bug: 20674674
Change-Id: Iace5b8c882339b3a9d2e706375255aeeeb0532fe

Bug: 20674086
Change-Id: I2ee6b7e0eabbf696c0986d08b2d759d48cb9eb7b

Bug: 22008959
Change-Id: I5f6e188adcc593796455bdaf7b0b8aba672b106e

BUG: 20674086
Change-Id: Idaff17975b327adea65c39bdba1ab4e88789c0cd

bug: 22845824
Change-Id: I8c375790c697e02b6ab3ea54b84d3f70d5e78141
(cherry picked from commit 346de3c2)

Bug: 23248776
Change-Id: I45cf53e58e4375afcf260b122264c968ec0ff6c8
(cherry picked from commit 3bf1e0fd)

Bug: 20674674

Change-Id: If80186a7b9078e575d389220f3bebe9f7630a956
(cherry picked from commit f6fe4340)

bug: 23016072
Change-Id: If3c9a835408773847c0024a812bd8b4915ebd680
(cherry picked from commit fa8ebb45)

The output buffer size as per opus project's sample decoder [1] is
960*6*channel_count. Whereas in SoftOpus, we use 960*6 (without the
channel count multiplier. Fixing it to include maximum number of
channels possible as the multiplier.

[1] http://git.xiph.org/?p=opus-tools.git;a=blob;f=src/opusdec.c;h=d085f04eacdfd49759ffdb73db805562ba396720;hb=f2a2e88b47f6f24083a37be476f140f677fe7160#l571

BUG=20721050

Change-Id: I323891a1b11491782bc093477b09e7757b885674
(cherry picked from commit 08e82275)

Bug: 21814993
Change-Id: Idaac61b4b9f4058b94e84093644593ba315d72ff
(cherry picked from commit c1a104aa)

Bug:23213430

Change-Id: I6f2e2b03b968a569b122004b4803c5d17fccfb12
(cherry picked from commit 635bc8f9)

Bug: 22077698
Change-Id: I2beb724662d041ad2339d0f4c7f983e7ac5e5e6f
(cherry picked from commit 94b0badc)

Bug: 22388975
Change-Id: I3c157b1029d37f6a22e6302ea7b52077fe27ce53
(cherry picked from commit 529c595b)

Bug: 23142203
Change-Id: I309df51e4df6412655f04cc093d792bf6c7944f7
(cherry picked from commit 9dd01777)

Bug: 23129786
Change-Id: I2e6b7a6927aa4362ab49dd6824bbb1abf7b4e661
(cherry picked from commit 09da8691)

Bug: 23036083
Bug: https://code.google.com/p/android/issues/detail?id=182053
Change-Id: I1a5cbe06990900160c2addade238c1e9feab8f71
(cherry picked from commit c63cc509)

If size == SIZE_MAX, the line:

  uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

ends up allocating zero bytes, which is obviously incorrect.

(cherry picked from commit b2d33aee)

Bug: 23031033
Change-Id: I8027247a4e24d2c8a8b4eac88c3643eccda108b9

Instead of rejecting the samples later when they don't fit in the
buffer, reject the entire file early.

Bug: 22882938
Change-Id: I748153b0e9e827e3f2526468756295b4b5000de6
(cherry picked from commit beef7e58)

Bug: 22954006
Change-Id: I488cb1e2c69fc7043b6040481b30fa866000515d

Bug: 20139950
Bug: 22935234
(cherry picked from commit a105482a)

Change-Id: I408d261de1a6dd5c4343bcf3a7dfd8a259e0e2f3

Limit number of ports and patches listed by
LIST_AUDIO_PATCHES and LIST_AUDIO_PORTS.

Also fix typo causing wring pointer to be used when writing to Parcel.

Bug: 19573085.
Change-Id: I41a9c710e45738a4f11990160587856c429a4646

This reverts commit d3831760.

Change-Id: I0509f7eadb3a27c4cadbd3088cb57a588463f457

Bug: 22414321

Change-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc
related-to-bug: 18394494
related-to-bug: 19664283
(cherry picked from commit 2fb561a6)

chunk_size is a uint64_t, so it can legitimately be bigger
than SIZE_MAX, which would cause the subtraction to underflow.

https://code.google.com/p/android/issues/detail?id=182251

Bug: 23034759
Change-Id: Ic1637fb26bf6edb0feb1bcf2876fd370db1ed547

Bug: 21296336
Change-Id: I78be5141b3108142f12d7cb94839fa50f776d84a

This reverts commit d3831760.

Change-Id: I0509f7eadb3a27c4cadbd3088cb57a588463f457

Bug: 22414321

Change-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc
related-to-bug: 18394494
related-to-bug: 19664283
(cherry picked from commit 2fb561a6)

When processing 3GPP metadata, a subtraction operation may underflow and
lead to a rather large linear byteswap operation in the subsequent
framedata decoding code. Bound the 'size' value to prevent this from
occurring.

Bug: 20923261
Change-Id: I35dfbc8878c6b65cfe8b8adb7351a77ad4d604e5
(cherry picked from commit 9458e715)

If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur
and cause an undersized buffer to be allocated. The following processing
then overfills the resulting memory and creates a potentially exploitable
condition. Ensure that integer overflow does not occur.

Bug: 20923261
Change-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f

Metadata processed within the parse3GPPMetaData function may not be NUL
terminated and thus calling setCString may read out of bounds. Ensure
proper NUL termination, but take care not to interfere with other special
cases (ie, albm).

Bug: 20923261
Change-Id: Ie93b3038b534b4c4460571a68f4d734cff7ad324
(cherry picked from commit 5cea0155)

Check consistency of effect command reply sizes before
copying to reply address.

Also add null pointer check on reply size.
Also remove unused parameter warning.

Bug: 21953516.
Change-Id: I4cf00c12eaed696af28f3b7613f7e36f47a160c4
(cherry picked from commit 0f714a46)

When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.

Bug: 20923261
Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f

When the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an
integer underflow can occur. This causes an extraordinarily large value to
be passed to MetaData::setData, leading to a buffer overflow.

Bug: 20923261
Change-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b

Bug: 20634516
Change-Id: Iac9eac3cb251eccd9bbad5df7421a07edc21da0c
(cherry picked from commit 2d6b6601)

Bug: 20634516
Change-Id: If351dbd573bb4aeb6968bfa33f6d407225bc752c
(cherry picked from commit d971df0e)

bug: 20222489
Change-Id: I3a64a5999d68ea243d187f12ec7717b7f26d93a3
(cherry picked from commit 532cd7b8)

Bug: 19641538
Change-Id: I5aae3f100846c125decc61eec7cd6563e3f33777

Bug: 19400722
Change-Id: Ib3afdf73fd4647eeea5721c61c8b72dbba0647f6

Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950

(cherry picked from commit 07c0f59d)

Change-Id: I377d21051e07ca654ea1f7037120429d3f71924a