aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
|\ | | | | | | | | | | info am: dc880988f0 am: 64b670e10a Change-Id: If3b0d271ec214b0ec04f33639f9276d591665e36
| * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| |\ | | | | | | | | | | | | | | | info am: dc880988f0 Change-Id: Id25465c6c5697a53b41ab5ceeb5a4ad68b6ddcb9
| | * DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-02-010-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
* | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
|\| | | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 am: c48482d937 Change-Id: I3ad03691188f287aaea76280aaafc2485fe66a75
| * | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| |\| | | | | | | | | | | | | | | | info am: 08ae2e8d12 am: 99f3e5ce05 Change-Id: I75bccc4690579a56ec343b735e94d54bbd780e92
| | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-02-010-0/+0
| | |\ | | | | | | | | | | | | | | | | | | | | info am: 08ae2e8d12 Change-Id: I6afb07170037b0e27738cbe7e53dc3d733fbd874
| | | * DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-02-010-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
* | | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
|\| | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 am: 4523eae489 Change-Id: I14943f95747e93f1e85cf560fe63fa11b168c9e3
| * | | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| |\| | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 am: 6dd431c768 Change-Id: I41f5e9a24af3c7a979c628df1be114185e02a8f7
| | * | [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | |\| | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e am: adc8026945 Change-Id: I9d3b87e62af0f54c01ced2e3aac41fa8e96cb056
| | | * [automerger] DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height ↵Android Build Merger (Role)2018-01-311-4/+19
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | info am: 4a54666f3e Change-Id: If7874381cdfce6cced128082b35cbd6ab21f709d
| | | | * DO NOT MERGE MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-01-131-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
* | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 Change-Id: I15f8ada5cbf90deefb7e9d2221a58a3b8f8dd038
| * | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 Change-Id: I526341d43af40089117110cfff2f41586121e5ff
| | * | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 Change-Id: Id97f3b0f0b59445fe85ab7c957e84d6be65f565b
| | | * | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours Change-Id: I30f8ee01f8a715cabf8edb10edf15bad032f5001
| | | | * Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵TreeHugger Robot2017-11-031-4/+8
| | | | |\ | | | | | | | | | | | | | | | | | | lmp-mr1-dev
| | | | | * DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
* | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
| * | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754Jean-Michel Trivi2017-11-031-3/+7
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: fca1027937 Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
| | * | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20Jean-Michel Trivi2017-11-031-3/+7
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 2a7b438754 Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
| | | * | | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-11-031-3/+7
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6d3dd40e20 Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
| | | | * | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-10-311-3/+7
| | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a reasonable value to guarantee correct termination in while loop in lppTransposer function. This fixes the reported bug. For completeness: - clear the whole bwIndex array instead of noOfPatches entries only. - abort criterion in while loop to prevent potential infinite loop, and limit bwIndex[patch] to a valid range. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65280786 Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
* | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 Change-Id: I4645d168431438e8bfbfc28514f21aad015633ac
| * | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7bJean-Michel Trivi2017-11-030-0/+0
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 Change-Id: I064298bc197e53e6f5a6ce1872cb77c9444d8dee
| | * | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-030-0/+0
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | am: d0e8397b7b Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
| | | * | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0Jean-Michel Trivi2017-11-031-4/+8
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6fac7101c6 Change-Id: If3c68bd6341d7c9eff5257ec41ca6c1a2161077c
| * | | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-031-4/+8
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 070e7b81c0 Change-Id: Ibcddd5c0e53aaae0d26e1c33c6e42bc7268cf6a1
| | * | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | | | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f am: d110691d01 * commit 'd110691d01e15a555d84fcd98e4b275dd38b37ba': Fix aacDecoder_drcExtractAndMap() Change-Id: I6c009e94d626cc1dd6ec1510fd2e07c1b3a4031a
| * | | | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
|/| | | | | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f * commit '1de50b286fdadc07f94e0d8fae69a564796ab12a': Fix aacDecoder_drcExtractAndMap() Change-Id: Ib1dce026d6ddc9fdfa68cc5b4213a2685dc1ac17
| * / / Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
|/| | | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 * commit '7147e71a75a48009e6d2b835422767cf466813d8': Fix aacDecoder_drcExtractAndMap() Change-Id: I7f677fae038640739834d4c44309680b78748acf
| * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 * commit '6318d6024194f89d809f4e22266105f27389f41b': Fix aacDecoder_drcExtractAndMap() Change-Id: I1a836bd8b024948f18b2d2c0e912601722f887bc
| | * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 * commit '0a209598713cccc4f10e9c0036df487bea5af312': Fix aacDecoder_drcExtractAndMap() Change-Id: If2339aad0e0e825302773f2f04f0dd43cc754ac6
| | * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 * commit '78653b30e9c1907d4c6eefa30ff954e0c4398447': Fix aacDecoder_drcExtractAndMap() Change-Id: I53cabb3bab17e8754a03648ffac356e4a3a05e28
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4fJean-Michel Trivi2016-04-191-9/+1
| | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 1a54e8f638 * commit '1a54e8f6385f9cbb8d950f0ff003bb71daa62caf': Fix aacDecoder_drcExtractAndMap() Change-Id: I3c992ce7d3a60685f75a944d8d588fb9ff0d050c
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425Jean-Michel Trivi2016-04-191-9/+1
| | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: b762ff3e4f * commit 'b762ff3e4fdc29ce517824e19d187ba667e80623': Fix aacDecoder_drcExtractAndMap() Change-Id: I29eaf51574e1834f223a9755a353abd90fcf912b
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140dJean-Michel Trivi2016-04-191-9/+1
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: be3ff35425 * commit 'be3ff35425f026fb3714f1bd45c40aee6737fe05': Fix aacDecoder_drcExtractAndMap() Change-Id: I82060408eab9a8990c511af4c6be8a588d2a1b49
| | | | * Fix aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-04-191-9/+1
| | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 97a1b8140d * commit '97a1b8140d410ed3942006aa22b40ccb322f747b': Fix aacDecoder_drcExtractAndMap() Change-Id: I1bf523e635139d71ef124462bd61e0da06191d35
| | | | * Fix aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-04-151-9/+1
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Parse DVB DRC data only when numThreads is below MAX_DRC_THREADS. The post-increment is necessary as it is used in fill element DRC data section. This solution parses as many DRC payloads as allowed by MAX_DRC_THREADS and skips all remaining DRC elements in the stream. Bug 27792766 Bug 26751339 Change-Id: Ie1641888bac1757c4d1491119f977fc5d436eaea
* | | | Fix stack corruption happening in aacDecoder_drcExtractAndMap() am: a06d1c2 ↵Jean-Michel Trivi2016-03-221-1/+9
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 47739cd am: 118fc75 * commit '118fc75eee6cc763a3105d6e963b77d76d114a2e': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| * | | Fix stack corruption happening in aacDecoder_drcExtractAndMap() am: a06d1c2Jean-Michel Trivi2016-03-221-1/+9
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | am: 47739cd * commit '47739cd9d8d7842436b90ef14207c935b0a799fe': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| | * | Fix stack corruption happening in aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-03-221-1/+9
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | am: a06d1c2 * commit 'a06d1c2b9af1621037b48557aac42b5ecbdb03b3': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| | | * Fix stack corruption happening in aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-03-211-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the aacDecoder_drcExtractAndMap() function, self->numThreads can be used after having exceeded its intended max value, MAX_DRC_THREADS, causing memory to be cleared after the threadBs[MAX_DRC_THREADS] array. The crash is prevented by never using self->numThreads with a value equal to or greater than MAX_DRC_THREADS. A proper fix will be required as there seems to be an issue as to which entry in the threadBs array is meant to be initialized and used. Bug 26751339 Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a
* | | | Remove __DATE__/__TIME__Dan Willemsen2015-10-3011-0/+55
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Building __DATE__/__TIME__ into the binaries means that every build will create different binaries, even if all the sources are identical. This also means that any libraries including this one will need to be patched during every OTA. Nothing appears to use the build_date/build_time fields, so just replace them with empty strings. Bug: 24204119 Change-Id: I9543eb388a1e8ab9284df9035a62fc8942cdc082 (cherry picked from commit 6e8330732f61d1da1485fc07b61444f490d5e623)
* | | am b3c5a4bb: Fix crash on invalid channel configMarco Nelissen2015-09-151-2/+5
|\| | | | | | | | | | | | | | * commit 'b3c5a4bb8442ab3158fa1f52b790fadc64546f46': Fix crash on invalid channel config
| * | Fix crash on invalid channel configMarco Nelissen2015-09-081-2/+5
| | | | | | | | | | | | | | | Bug: 23876444 Change-Id: I90ad197811ebabceb5b5d74d6d3f20716fbe2d45
* | | am f2df045a: Merge commit \'10d211b84a5f0790b28fcc8b3db66884d5f9c729\' into HEADBill Yi2015-02-200-0/+0
|\ \ \ | | | | | | | | | | | | * commit 'f2df045ae92ee655481f73b19986084308ae684c':
| * \ \ Merge commit '10d211b84a5f0790b28fcc8b3db66884d5f9c729' into HEADBill Yi2015-02-190-0/+0
| |\ \ \
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-22 08:14:28 +0000