Jean-Michel Trivi
c9026ad89b
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993 am: ad2e179de6
...
am: fb4d8cc62f
Change-Id: Ie726294fece52e3587d2942d5b7442eefad125b1
2017-11-03 19:28:52 +00:00
Jean-Michel Trivi
77aac03fb6
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380
...
am: 902decfc99
Change-Id: I04632c3154dddc9c6b7b80d4f3393dc20194dd27
2017-11-03 19:28:41 +00:00
Jean-Michel Trivi
a9a123b2fb
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce am: 67a321cd17
...
am: 0c25940e1c
Change-Id: I599488f38c5b080533988d48edc0ee1df80c9da9
2017-11-03 19:28:29 +00:00
Jean-Michel Trivi
849c9b161a
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8 am: a8eba4b634
...
am: c7048181c0
Change-Id: I7d1de9b9cf9e03a03d27b5f5fd89eb08ff12f280
2017-11-03 19:28:08 +00:00
Jean-Michel Trivi
fb4d8cc62f
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours am: 41363eb993
...
am: ad2e179de6
Change-Id: I29f8bb0bb8accc369636d8d8726f7b505ce081d2
2017-11-03 19:25:38 +00:00
Jean-Michel Trivi
902decfc99
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb
...
am: e6b649a380
Change-Id: I54610df83d3e84021bd71e81c2f910545908c986
2017-11-03 19:25:27 +00:00
Jean-Michel Trivi
0c25940e1c
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours am: 724b40ccce
...
am: 67a321cd17
Change-Id: I07c673dbbdab32f515bbefb52bd4495c83664ccf
2017-11-03 19:25:17 +00:00
Jean-Michel Trivi
c7048181c0
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours am: 272ae57aa8
...
am: a8eba4b634
Change-Id: I7c719af7670774f2db0f01d8a97199d4b3889be4
2017-11-03 19:25:05 +00:00
Jean-Michel Trivi
ad2e179de6
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55 am: 75fe8cb95e -s ours
...
am: 41363eb993
Change-Id: Ia506184ac99982b5602daccfa0ef2471965ef99a
2017-11-03 19:21:42 +00:00
Jean-Michel Trivi
e6b649a380
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97
...
am: 06c27a9feb
Change-Id: Id5bfc33a815aec69a302b5ba1460ad2d556c9179
2017-11-03 19:21:31 +00:00
Jean-Michel Trivi
67a321cd17
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65 am: d157498711 -s ours
...
am: 724b40ccce
Change-Id: Ia566e7de7c215e77bd6d6f0f1f069a855b9edc02
2017-11-03 19:21:18 +00:00
Jean-Michel Trivi
a8eba4b634
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6 am: 96fbbc31db -s ours
...
am: 272ae57aa8
Change-Id: Id7da9dba87a2951901e0732e666cd84b1e6d573e
2017-11-03 19:21:05 +00:00
Jean-Michel Trivi
41363eb993
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2 am: 022a305d55
...
am: 75fe8cb95e -s ours
Change-Id: I0c790baf5af9e6d15efbbf7cd175770696aa7391
2017-11-03 19:19:32 +00:00
Jean-Michel Trivi
06c27a9feb
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e
...
am: 6e15baff97
Change-Id: Ic11d63d594dabfb8359d19eb36f9bdcc56abd2ac
2017-11-03 19:19:22 +00:00
Jean-Michel Trivi
724b40ccce
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43 am: 2bebb8fb65
...
am: d157498711 -s ours
Change-Id: Ica332afb180137b27845c06d35108928102826f6
2017-11-03 19:19:04 +00:00
Jean-Michel Trivi
75fe8cb95e
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909 am: c0719825a2
...
am: 022a305d55
Change-Id: I15f8ada5cbf90deefb7e9d2221a58a3b8f8dd038
2017-11-03 19:17:35 +00:00
Jean-Michel Trivi
6e15baff97
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937
...
am: d8e897ae9e
Change-Id: Id2b60900e4abe08d2f1c1612e7c729c75f2e61c0
2017-11-03 19:16:22 +00:00
Jean-Michel Trivi
d948041971
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d am: 5285345743
...
am: 3e28ad2039
Change-Id: I410dc4905aaa0cceeb40d4a6d7ef5072c93ee6ae
2017-11-03 19:16:06 +00:00
Jean-Michel Trivi
022a305d55
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours am: e1d517a909
...
am: c0719825a2
Change-Id: I526341d43af40089117110cfff2f41586121e5ff
2017-11-03 19:16:06 +00:00
Jean-Michel Trivi
272ae57aa8
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0 am: 6fac7101c6
...
am: 96fbbc31db -s ours
Change-Id: Icab41a4c796ad9f31128dd8289ea4839d5823605
2017-11-03 19:16:05 +00:00
Jean-Michel Trivi
d157498711
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b am: 7462464e43
...
am: 2bebb8fb65
Change-Id: I4645d168431438e8bfbfc28514f21aad015633ac
2017-11-03 19:16:05 +00:00
Jean-Michel Trivi
3e28ad2039
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 51f38b3a6d
...
am: 5285345743
Change-Id: Ia99bbf37644c24b32d967e6736b913da605f2d12
2017-11-03 19:14:05 +00:00
Jean-Michel Trivi
c0719825a2
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev am: 5565e7791f -s ours
...
am: e1d517a909
Change-Id: Id97f3b0f0b59445fe85ab7c957e84d6be65f565b
2017-11-03 19:14:05 +00:00
Jean-Michel Trivi
d8e897ae9e
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754
...
am: fca1027937
Change-Id: I8803d858a432aea8fba8b7ec29ba28458e7418d8
2017-11-03 19:13:45 +00:00
Jean-Michel Trivi
a1deac7b1a
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
am: 3b6a14a1e0
Change-Id: Id527e5320a362042ef0c65329082a369687e9db7
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
96fbbc31db
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: 070e7b81c0
...
am: 6fac7101c6
Change-Id: If3c68bd6341d7c9eff5257ec41ca6c1a2161077c
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
2bebb8fb65
DO NOT MERGE Prevent out of bound memory access in GetInvInt am: d0e8397b7b
...
am: 7462464e43
Change-Id: I064298bc197e53e6f5a6ce1872cb77c9444d8dee
2017-11-03 19:13:34 +00:00
Jean-Michel Trivi
5285345743
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
am: 51f38b3a6d
Change-Id: I01d4479fd2194e85b77b11d678facb7f581ff517
2017-11-03 19:10:33 +00:00
Jean-Michel Trivi
e1d517a909
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev
...
am: 5565e7791f -s ours
Change-Id: I30f8ee01f8a715cabf8edb10edf15bad032f5001
2017-11-03 19:10:33 +00:00
Jean-Michel Trivi
fca1027937
Fix out of bound memory access in lppTransposer am: 6d3dd40e20
...
am: 2a7b438754
Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
2017-11-03 19:10:25 +00:00
Jean-Michel Trivi
6fac7101c6
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
am: 070e7b81c0
Change-Id: Ibcddd5c0e53aaae0d26e1c33c6e42bc7268cf6a1
2017-11-03 19:10:04 +00:00
Jean-Michel Trivi
7462464e43
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
am: d0e8397b7b
Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
2017-11-03 19:10:04 +00:00
Jean-Michel Trivi
2a7b438754
Fix out of bound memory access in lppTransposer
...
am: 6d3dd40e20
Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
2017-11-03 19:07:04 +00:00
TreeHugger Robot
5565e7791f
Merge "DO NOT MERGE Prevent out of bound memory access in GetInvInt" into lmp-mr1-dev
2017-11-03 19:05:37 +00:00
Jean-Michel Trivi
3b6a14a1e0
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 18:52:41 +00:00
Jean-Michel Trivi
51f38b3a6d
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
2017-11-02 16:25:34 +00:00
Jean-Michel Trivi
6d3dd40e20
Fix out of bound memory access in lppTransposer
...
In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
reasonable value to guarantee correct termination in while loop
in lppTransposer function. This fixes the reported bug.
For completeness:
- clear the whole bwIndex array instead of noOfPatches entries only.
- abort criterion in while loop to prevent potential
infinite loop, and limit bwIndex[patch] to a valid range.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786
Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
2017-10-31 21:40:14 +00:00
Jean-Michel Trivi
070e7b81c0
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
2017-10-30 22:46:18 +00:00
Jean-Michel Trivi
76c4625fe3
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Id1f1582bc5afc76e3e90128d92034a5899a9b51e
2017-10-30 22:45:05 +00:00
Jean-Michel Trivi
d0e8397b7b
DO NOT MERGE Prevent out of bound memory access in GetInvInt
...
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
2017-10-30 15:20:44 -07:00
Jean-Michel Trivi
9000e05228
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f am: d110691d01 am: 0cf3a7671a
...
am: 9d4702f2d9
* commit '9d4702f2d9ecec00c4e28de638b1f79afb5d696c':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I529c52632aba617404f16995fefc8138f5d993e2
2016-04-19 01:34:40 +00:00
Jean-Michel Trivi
9d4702f2d9
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f am: d110691d01
...
am: 0cf3a7671a
* commit '0cf3a7671ad40c1036387d55462f1710a44eec31':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I7ca67acba7d69472865efa84a63a49c7768487c5
2016-04-19 01:32:26 +00:00
Jean-Michel Trivi
0cf3a7671a
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 am: 1de50b286f
...
am: d110691d01
* commit 'd110691d01e15a555d84fcd98e4b275dd38b37ba':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I6c009e94d626cc1dd6ec1510fd2e07c1b3a4031a
2016-04-19 01:30:15 +00:00
Jean-Michel Trivi
d110691d01
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75
...
am: 1de50b286f
* commit '1de50b286fdadc07f94e0d8fae69a564796ab12a':
Fix aacDecoder_drcExtractAndMap()
Change-Id: Ib1dce026d6ddc9fdfa68cc5b4213a2685dc1ac17
2016-04-19 01:27:53 +00:00
Jean-Michel Trivi
1de50b286f
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241
...
am: 7147e71a75
* commit '7147e71a75a48009e6d2b835422767cf466813d8':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I7f677fae038640739834d4c44309680b78748acf
2016-04-19 01:25:09 +00:00
Jean-Michel Trivi
7147e71a75
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871
...
am: 6318d60241
* commit '6318d6024194f89d809f4e22266105f27389f41b':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I1a836bd8b024948f18b2d2c0e912601722f887bc
2016-04-19 01:00:01 +00:00
Jean-Michel Trivi
6318d60241
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638 am: 78653b30e9
...
am: 0a20959871
* commit '0a209598713cccc4f10e9c0036df487bea5af312':
Fix aacDecoder_drcExtractAndMap()
Change-Id: If2339aad0e0e825302773f2f04f0dd43cc754ac6
2016-04-19 00:57:44 +00:00
Jean-Michel Trivi
0a20959871
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f am: 1a54e8f638
...
am: 78653b30e9
* commit '78653b30e9c1907d4c6eefa30ff954e0c4398447':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I53cabb3bab17e8754a03648ffac356e4a3a05e28
2016-04-19 00:55:30 +00:00
Jean-Michel Trivi
78653b30e9
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4f
...
am: 1a54e8f638
* commit '1a54e8f6385f9cbb8d950f0ff003bb71daa62caf':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I3c992ce7d3a60685f75a944d8d588fb9ff0d050c
2016-04-19 00:53:17 +00:00
Jean-Michel Trivi
1a54e8f638
Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425
...
am: b762ff3e4f
* commit 'b762ff3e4fdc29ce517824e19d187ba667e80623':
Fix aacDecoder_drcExtractAndMap()
Change-Id: I29eaf51574e1834f223a9755a353abd90fcf912b
2016-04-19 00:50:57 +00:00