aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
|\ | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 am: c48482d937 skipped: 81ea4ba91d am: 46ead43c76 am: 0bbb81398c Change-Id: Ibed017aec202e84aade79f805866c7102bdffa03
| * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| |\ | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 am: c48482d937 skipped: 81ea4ba91d am: 46ead43c76 Change-Id: I50bab67ba74e6892895a9ad7aae4dc221f03ad89
| | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| | |\ | | | | | | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 am: c48482d937 skipped: 81ea4ba91d Change-Id: I06431e0b18182521b2decfac9a890b3f61cd5593
| | | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 am: c48482d937 Change-Id: I3ad03691188f287aaea76280aaafc2485fe66a75
| | | | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 Change-Id: I75bccc4690579a56ec343b735e94d54bbd780e92
| | | | | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 08ae2e8d12 Change-Id: I6afb07170037b0e27738cbe7e53dc3d733fbd874
| | | | | | * DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-02-010-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
* | | | | | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-310-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 am: 4523eae489 skipped: b2d0afac05 am: 14728790d3 am: 1296b91454 Change-Id: I22ec8d38c1303f98be7f21e6ecce3bcb42ee7e61
| * | | | | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-310-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 am: 4523eae489 skipped: b2d0afac05 am: 14728790d3 Change-Id: I7899630b98b1a7a1c8de7559aaaf9bc44a250c66
| | * | | | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-310-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 am: 4523eae489 skipped: b2d0afac05 Change-Id: Ie400d21f7fefabed6c91b4b04880bd80e6153b20
| | | * | | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 am: 4523eae489 Change-Id: I14943f95747e93f1e85cf560fe63fa11b168c9e3
| | | | * | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 Change-Id: I41f5e9a24af3c7a979c628df1be114185e02a8f7
| | | | | * | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 Change-Id: I9d3b87e62af0f54c01ced2e3aac41fa8e96cb056
| | | | | | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e Change-Id: If7874381cdfce6cced128082b35cbd6ab21f709d
| | | | | | | * DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-01-131-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
* | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 Change-Id: I29f8bb0bb8accc369636d8d8726f7b505ce081d2
| * | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 Change-Id: Ia506184ac99982b5602daccfa0ef2471965ef99a
| | * | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours Change-Id: I0c790baf5af9e6d15efbbf7cd175770696aa7391
| | | * | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 Change-Id: I15f8ada5cbf90deefb7e9d2221a58a3b8f8dd038
| | | | * | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 Change-Id: I526341d43af40089117110cfff2f41586121e5ff
| | | | | * | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 Change-Id: Id97f3b0f0b59445fe85ab7c957e84d6be65f565b
| | | | | | * | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours Change-Id: I30f8ee01f8a715cabf8edb10edf15bad032f5001
| | | | | | | * Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵TreeHugger Robot2017-11-031-4/+8
| | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev
| | | | | | | | * DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
* | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 Change-Id: I54610df83d3e84021bd71e81c2f910545908c986
| * | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb Change-Id: Id5bfc33a815aec69a302b5ba1460ad2d556c9179
| | * | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 Change-Id: Ic11d63d594dabfb8359d19eb36f9bdcc56abd2ac
| | | * | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
| | | | * | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754Jean-Michel Trivi2017-11-031-3/+7
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: fca1027937 Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
| | | | | * | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20Jean-Michel Trivi2017-11-031-3/+7
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 2a7b438754 Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
| | | | | | * | | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-11-031-3/+7
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6d3dd40e20 Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
| | | | | | | * | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-10-311-3/+7
| | | | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a reasonable value to guarantee correct termination in while loop in lppTransposer function. This fixes the reported bug. For completeness: - clear the whole bwIndex array instead of noOfPatches entries only. - abort criterion in while loop to prevent potential infinite loop, and limit bwIndex[patch] to a valid range. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65280786 Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
* | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 Change-Id: I07c673dbbdab32f515bbefb52bd4495c83664ccf
| * | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce Change-Id: Ia566e7de7c215e77bd6d6f0f1f069a855b9edc02
| | * | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours Change-Id: Ica332afb180137b27845c06d35108928102826f6
| | | * | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 Change-Id: I4645d168431438e8bfbfc28514f21aad015633ac
| | | | * | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7bJean-Michel Trivi2017-11-030-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 Change-Id: I064298bc197e53e6f5a6ce1872cb77c9444d8dee
| | | | | * | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-030-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: d0e8397b7b Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
| | | | | | * | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 ↵Jean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634 Change-Id: I7c719af7670774f2db0f01d8a97199d4b3889be4
| * | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 ↵Jean-Michel Trivi2017-11-030-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 Change-Id: Id7da9dba87a2951901e0732e666cd84b1e6d573e
| | * | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 ↵Jean-Michel Trivi2017-11-030-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6fac7101c6 am: 96fbbc31db -s ours Change-Id: Icab41a4c796ad9f31128dd8289ea4839d5823605
| | | * | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0Jean-Michel Trivi2017-11-031-4/+8
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6fac7101c6 Change-Id: If3c68bd6341d7c9eff5257ec41ca6c1a2161077c
| | | | * | | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-031-4/+8
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 070e7b81c0 Change-Id: Ibcddd5c0e53aaae0d26e1c33c6e42bc7268cf6a1
| | | | | * | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6dJean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 5285345743 Change-Id: Ia99bbf37644c24b32d967e6736b913da605f2d12
| * | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-031-4/+8
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 51f38b3a6d Change-Id: I01d4479fd2194e85b77b11d678facb7f581ff517
| | * | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-021-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
* | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-021-4/+8
|/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
* | | | | | | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-190-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f am: d110691d01 am: 0cf3a7671a am: 9d4702f2d9 * commit '9d4702f2d9ecec00c4e28de638b1f79afb5d696c': Fix aacDecoder_drcExtractAndMap() Change-Id: I529c52632aba617404f16995fefc8138f5d993e2
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 15:16:27 +0000