Skip to content

GitLab

Switch branch/tag
  1. 09 Jul, 2015 14 commits
    • Joshua J. Drake's avatar
      Prevent integer underflow if size is below 6 · f4f7e0c1
      Joshua J. Drake authored 
      When processing 3GPP metadata, a subtraction operation may underflow and
lead to a rather large linear byteswap operation in the subsequent
framedata decoding code. Bound the 'size' value to prevent this from
occurring.

Bug: 20923261
Change-Id: I35dfbc8878c6b65cfe8b8adb7351a77ad4d604e5
(cherry picked from commit 9458e715)
      f4f7e0c1
    • Joshua J. Drake's avatar
      Prevent integer overflow when processing covr MPEG4 atoms · 2674a721
      Joshua J. Drake authored 
      If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur
and cause an undersized buffer to be allocated. The following processing
then overfills the resulting memory and creates a potentially exploitable
condition. Ensure that integer overflow does not occur.

Bug: 20923261
Change-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f
      2674a721
    • Joshua J. Drake's avatar
      Prevent reading past the end of the buffer in 3GPP · e846a5f3
      Joshua J. Drake authored 
      Metadata processed within the parse3GPPMetaData function may not be NUL
terminated and thus calling setCString may read out of bounds. Ensure
proper NUL termination, but take care not to interfere with other special
cases (ie, albm).

Bug: 20923261
Change-Id: Ie93b3038b534b4c4460571a68f4d734cff7ad324
(cherry picked from commit 5cea0155)
      e846a5f3
    • Eric Laurent's avatar
      audio effects: fix heap overflow · aeea52da
      Eric Laurent authored 
      Check consistency of effect command reply sizes before
copying to reply address.

Also add null pointer check on reply size.
Also remove unused parameter warning.

Bug: 21953516.
Change-Id: I4cf00c12eaed696af28f3b7613f7e36f47a160c4
(cherry picked from commit 0f714a46)
      aeea52da
    • Joshua J. Drake's avatar
      Fix integer overflow when handling MPEG4 tx3g atom · 463a6f80
      Joshua J. Drake authored 
      When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.

Bug: 20923261
Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f
      463a6f80
    • Joshua J. Drake's avatar
      Fix integer underflow in covr MPEG4 processing · f4a88c8e
      Joshua J. Drake authored 
      When the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an
integer underflow can occur. This causes an extraordinarily large value to
be passed to MetaData::setData, leading to a buffer overflow.

Bug: 20923261
Change-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b
      f4a88c8e
    • Andy Hung's avatar
      IOMX: Enable buffer ptr to buffer id translation for arm32 · 3cb1b694
      Andy Hung authored 
      Bug: 20634516
Change-Id: Iac9eac3cb251eccd9bbad5df7421a07edc21da0c
(cherry picked from commit 2d6b6601)
      3cb1b694
    • Andy Hung's avatar
      IOMX: Add buffer range check to emptyBuffer · 086d84f4
      Andy Hung authored 
      Bug: 20634516
Change-Id: If351dbd573bb4aeb6968bfa33f6d407225bc752c
(cherry picked from commit d971df0e)
      086d84f4
    • Chong Zhang's avatar
      HDCP: buffer over flow check -- DO NOT MERGE · c82e31a7
      Chong Zhang authored 
      bug: 20222489
Change-Id: I3a64a5999d68ea243d187f12ec7717b7f26d93a3
(cherry picked from commit 532cd7b8)
      c82e31a7
    • Lajos Molnar's avatar
      Add AUtils::isInRange, and use it to detect malformed MPEG4 nal sizes · d48f0f14
      Lajos Molnar authored 
      Bug: 19641538
Change-Id: I5aae3f100846c125decc61eec7cd6563e3f33777
      d48f0f14
    • Marco Nelissen's avatar
      Add some sanity checks · 51504928
      Marco Nelissen authored 
      Bug: 19400722
Change-Id: Ib3afdf73fd4647eeea5721c61c8b72dbba0647f6
      51504928
    • Joshua J. Drake's avatar
      Fix integer underflow in ESDS processing · 5e751957
      Joshua J. Drake authored 
      Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950

(cherry picked from commit 07c0f59d)

Change-Id: I377d21051e07ca654ea1f7037120429d3f71924a
      5e751957
    • Joshua J. Drake's avatar
      Fix integer overflow during MP4 atom processing · 2434839b
      Joshua J. Drake authored 
      A few sample table related FourCC values are handled by the
setSampleToChunkParams function. An integer overflow exists within this
function. Validate that mNumSampleToChunkOffets will not cause an integer
overflow.

Bug: 20139950

(cherry picked from commit c24607c2)

Change-Id: I49086952451b09a234d8b82669251ab9f1ef58d9
      2434839b
    • Joshua J. Drake's avatar
      Fix several ineffective integer overflow checks · cf1581c6
      Joshua J. Drake authored 
      Commit edd4a76e (which addressed bugs 15328708, 15342615, 15342751) added
several integer overflow checks. Unfortunately, those checks fail to take into
account integer promotion rules and are thus themselves subject to an integer
overflow. Cast the sizeof() operator to a uint64_t to force promotion while
multiplying.

Bug: 20139950

(cherry picked from commit e2e812e5)

Change-Id: I080eb3fa147601f18cedab86e0360406c3963d7b
      cf1581c6
  3. 31 Mar, 2015 2 commits
  5. 26 Mar, 2015 1 commit
  7. 11 Feb, 2015 1 commit
  9. 10 Feb, 2015 2 commits
  11. 09 Feb, 2015 1 commit
  13. 07 Feb, 2015 2 commits
  15. 06 Feb, 2015 5 commits
  17. 05 Feb, 2015 5 commits
  19. 04 Feb, 2015 7 commits