aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| | | * | | | | | | | | | | | | | | MPEG-4 AAC Decoder: check against invalid height info am: 772c7f5542Jean-Michel Trivi2018-01-310-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: b75592cd1a Change-Id: I0c302d058a8a8a83a53a83a6456fa328d0d6ff91
| | | | * | | | | | | | | | | | | | MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-01-311-4/+19
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 772c7f5542 Change-Id: Iba7581d349f0ac7cf6a1686347de5993ebaa0c10
| | | | | * | | | | | | | | | | | | MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-01-131-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
| | | * | | | | | | | | | | | | | | MPEG-4 AAC Decoder: check against invalid height infoJean-Michel Trivi2018-01-121-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CProgramConfig_ReadHeightExt prevent stack overflow from invalid FrontElementHeightInfo array value. Bug: 70637599 Test: see bug Change-Id: I145414d81d7a7be711672c12f44b537c12eea308
| | | * | | | | | | | | | | | | | | Merge "DO NOT MERGE: Merge Oreo MR1 into master" am: a3e0aa5f25 -s ours am: ↵Xin Li2017-12-080-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b9fc83e0e9 am: 9864473fde -s ours Change-Id: I4b949aca22cc3af4afae998a4d1845d113dd62a2
| | | | * | | | | | | | | | | | | | Merge "DO NOT MERGE: Merge Oreo MR1 into master" am: a3e0aa5f25 -s oursXin Li2017-12-070-0/+0
| | | | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | |_|/ / / / / / / / / / / / / / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: b9fc83e0e9 Change-Id: I62a6e9ad1994e416489ca103a972796c24e1418f
| | * | | | | | | | | | | | | | | | Merge "DO NOT MERGE: Merge Oreo MR1 into master"Xin Li2017-12-070-0/+0
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | |/ / / / / / / / / / / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: a3e0aa5f25 -s ours Change-Id: Ic4b4c468787b5a680e40d8bd915865cc4571ad92
| | | * | | | | | | | | | | | | | | Manually merge changes from giant AOSP topicStephen Li2017-12-070-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change-Id: I758f8cd61341d5dfb394245fb38bb9a6332fdc91
| | | | * | | | | | | | | | | | | | DO NOT MERGE: Merge Oreo MR1 into master am: ea031590ac -s oursXin Li2017-12-070-0/+0
| | | | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | |_|/ / / / / / / / / / / / / / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 990c02cb29 Change-Id: I64bb1cc03599ca1799afaa35d4c99c1e3411c0ba
| | * | | | | | | | | | | | | | | | DO NOT MERGE: Merge Oreo MR1 into masterXin Li2017-12-070-0/+0
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: ea031590ac -s ours Change-Id: Iff2c9429b44a8a7d7455b08018d44b3753964c63
| | | | * | | | | | | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b am: ee5b524516 -s ours am: 47a6f5a741 am: 211208b7a2 am: 433f0352e6 am: eb68748f5e -s ours Change-Id: I620c5d963f94a29decd4524f2756182c18bfea03
| | | | | * | | | | | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b am: ee5b524516 -s ours am: 47a6f5a741 am: 211208b7a2 am: 433f0352e6 Change-Id: I0828b798bd6203f58bc8fe961a767204d0b6b9db
| | | | | | * | | | | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b am: ee5b524516 -s ours am: 47a6f5a741 am: 211208b7a2 Change-Id: I8bbb0a392051d2966ac3fd587c6b5236f938b1ab
| | | | | | | * | | | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b am: ee5b524516 -s ours am: 47a6f5a741 Change-Id: Ia601448b406aaba329133b87b91108fe4cc9c045
| | | | | | | | * | | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b am: ee5b524516 -s ours Change-Id: Ied7799fd88769b44cbe09b5e12df20f2f9670d50
| | | | | | | | | * | | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f am: c9026ad89b Change-Id: Iba53050b91367ad11b29263f66d3e51236508a16
| | | | | | | | | | * | | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 am: fb4d8cc62f Change-Id: Ie726294fece52e3587d2942d5b7442eefad125b1
| | | | | | | | | | | * | | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6 Change-Id: I29f8bb0bb8accc369636d8d8726f7b505ce081d2
| | | | | | | | | | | | * | | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 Change-Id: Ia506184ac99982b5602daccfa0ef2471965ef99a
| | | | | | | | | | | | | * | | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours Change-Id: I0c790baf5af9e6d15efbbf7cd175770696aa7391
| | | | | | | | | | | | | | * | | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 Change-Id: I15f8ada5cbf90deefb7e9d2221a58a3b8f8dd038
| | | | | | | | | | | | | | | * | | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 Change-Id: I526341d43af40089117110cfff2f41586121e5ff
| | | | | | | | | | | | | | | | * | | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 Change-Id: Id97f3b0f0b59445fe85ab7c957e84d6be65f565b
| | | | | | | | | | | | | | | | | * | Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev am: 5565e7791f -s ours Change-Id: I30f8ee01f8a715cabf8edb10edf15bad032f5001
| | | | | | | | | | | | | | | | | | * Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into ↵TreeHugger Robot2017-11-031-4/+8
| | | | | | | | | | | | | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lmp-mr1-dev
| | | | | | | | | | | | | | | | | | | * DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
| | | | * | | | | | | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 am: 117691fe59 am: 60c9a6e4c7 am: 565a2fba56 am: 3c6799a870 Change-Id: I5c065e48a043c697c801f84a26bf9dedde9750da
| | | | | * | | | | | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 am: 117691fe59 am: 60c9a6e4c7 am: 565a2fba56 Change-Id: Ic783461700022ebe1e09db5a9f0f20c08a392e52
| | | | | | * | | | | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 am: 117691fe59 am: 60c9a6e4c7 Change-Id: I6551d0525de65b975ccae8abd0569597d9a39c9b
| | | | | | | * | | | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 am: 117691fe59 Change-Id: I28274f0fce7de6992f0c60c000bbecb0f21a3535
| | | | | | | | * | | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 Change-Id: Id4cceec7b64a1281bb922b76471f1bad7f283497
| | | | | | | | | * | | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 Change-Id: I513fd4f92c93ece5fae4bc4db29eb442e951be92
| | | | | | | | | | * | | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 Change-Id: I04632c3154dddc9c6b7b80d4f3393dc20194dd27
| | | | | | | | | | | * | | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 Change-Id: I54610df83d3e84021bd71e81c2f910545908c986
| | | | | | | | | | | | * | | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb Change-Id: Id5bfc33a815aec69a302b5ba1460ad2d556c9179
| | | | | | | | | | | | | * | | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 Change-Id: Ic11d63d594dabfb8359d19eb36f9bdcc56abd2ac
| | | | | | | | | | | | | | * | | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: ↵Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2a7b438754 am: fca1027937 am: d8e897ae9e Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
| | | | | | | | | | | | | | | * | | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: fca1027937 Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
| | | | | | | | | | | | | | | | * | | | Fix out of bound memory access in lppTransposer am: 6d3dd40e20Jean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 2a7b438754 Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
| | | | | | | | | | | | | | | | | * | | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-11-031-3/+7
| | | | | | | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 6d3dd40e20 Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
| | | | | | | | | | | | | | | | | | * | Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-10-311-3/+7
| | | | | | | | | | | | | | | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a reasonable value to guarantee correct termination in while loop in lppTransposer function. This fixes the reported bug. For completeness: - clear the whole bwIndex array instead of noOfPatches entries only. - abort criterion in while loop to prevent potential infinite loop, and limit bwIndex[patch] to a valid range. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65280786 Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
| | | | * | | | | | | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours am: 7517e7cd48 am: 0a9273a678 am: 7ae7912813 am: 199e87aa21 -s ours Change-Id: Ia6ea408b01d32741c3058fa08d1b75e656dda5cd
| | | | | * | | | | | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours am: 7517e7cd48 am: 0a9273a678 am: 7ae7912813 Change-Id: I6f643d9c75eab8c0556e927179aefa4d95513da4
| | | | | | * | | | | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours am: 7517e7cd48 am: 0a9273a678 Change-Id: Icdba42495f11c2dfe96ff97de77c7190f1602a71
| | | | | | | * | | | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours am: 7517e7cd48 Change-Id: I50823ae367196b85d815b3ed1c6ac1b4c80cdae5
| | | | | | | | * | | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb am: 083f093d1b -s ours Change-Id: I9f6da4a5c1377badab19374ef20ce7afde3321a2
| | | | | | | | | * | | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c am: a9a123b2fb Change-Id: I11f93ad48d89bef4647b9d7c081660765330d78c
| | | | | | | | | | * | | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 am: 0c25940e1c Change-Id: I599488f38c5b080533988d48edc0ee1df80c9da9
| | | | | | | | | | | * | | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17 Change-Id: I07c673dbbdab32f515bbefb52bd4495c83664ccf
| | | | | | | | | | | | * | | | | | | DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b ↵Jean-Michel Trivi2017-11-030-0/+0
| | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce Change-Id: Ia566e7de7c215e77bd6d6f0f1f069a855b9edc02
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 04:26:20 +0000