OSDN Git Service
Vignesh Venkatasubramanian [Thu, 11 Jun 2015 18:15:00 +0000 (11:15 -0700)]
SoftOpus: Fix output buffer capacity.
The output buffer size as per opus project's sample decoder [1] is
960*6*channel_count. Whereas in SoftOpus, we use 960*6 (without the
channel count multiplier. Fixing it to include maximum number of
channels possible as the multiplier.
[1] http://git.xiph.org/?p=opus-tools.git;a=blob;f=src/opusdec.c;h=
d085f04eacdfd49759ffdb73db805562ba396720;hb=
f2a2e88b47f6f24083a37be476f140f677fe7160#l571
BUG=
20721050
Change-Id: I323891a1b11491782bc093477b09e7757b885674
(cherry picked from commit
08e8227514f5ab99822dfae8b4d39414646ff59d)
Eric Laurent [Thu, 2 Apr 2015 20:49:15 +0000 (13:49 -0700)]
DO NOT MERGE - IAudioFlinger: add checks on binder calls
Limit number of ports and patches listed by
LIST_AUDIO_PATCHES and LIST_AUDIO_PORTS.
Also fix typo causing wrong pointer to be used when writing to Parcel.
Bug:
19573085.
Change-Id: I41a9c710e45738a4f11990160587856c429a4646
(cherry picked from commit
f75c2fef14354024ec27bff1444f9e50b5ef55a9)
Wei Jia [Thu, 13 Aug 2015 18:14:57 +0000 (18:14 +0000)]
am
88aa97ea: am
3ce29384: libstagefright: fix possible overflow in amrwbenc.
* commit '
88aa97ea87b7e4f7b4f82df3500754e03205ef60':
libstagefright: fix possible overflow in amrwbenc.
Wei Jia [Thu, 13 Aug 2015 18:08:00 +0000 (18:08 +0000)]
am
3ce29384: libstagefright: fix possible overflow in amrwbenc.
* commit '
3ce293842fed1b3abd2ff0aecd2a0c70a55086ee':
libstagefright: fix possible overflow in amrwbenc.
Wei Jia [Wed, 12 Aug 2015 17:08:41 +0000 (10:08 -0700)]
libstagefright: fix possible overflow in amrwbenc.
Bug:
23142203
Change-Id: I309df51e4df6412655f04cc093d792bf6c7944f7
(cherry picked from commit
9dd01777aa14bbb90a6cdccf97383bb4e3d717a5)
Wei Jia [Thu, 13 Aug 2015 16:42:54 +0000 (16:42 +0000)]
am
4e86a483: am
f51115bd: libstagefright: fix possible overflow in ID3.
* commit '
4e86a483a12b0139a8babf4754e5de340eaccd40':
libstagefright: fix possible overflow in ID3.
Wei Jia [Thu, 13 Aug 2015 16:34:17 +0000 (16:34 +0000)]
am
f51115bd: libstagefright: fix possible overflow in ID3.
* commit '
f51115bd8e44c2779b74477277c6f6046916e7cf':
libstagefright: fix possible overflow in ID3.
Wei Jia [Wed, 12 Aug 2015 17:41:00 +0000 (10:41 -0700)]
libstagefright: fix possible overflow in ID3.
Bug:
23129786
Change-Id: I2e6b7a6927aa4362ab49dd6824bbb1abf7b4e661
(cherry picked from commit
09da86913ca97d7a818a8917b6601527e5e18a24)
Nick Kralevich [Tue, 11 Aug 2015 05:04:40 +0000 (05:04 +0000)]
am
94f8150b: resolved conflicts for merge of
c86eae32 to klp-modular-dev
* commit '
94f8150be2041f73c2f185f2c3622a9537d47454':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 04:24:54 +0000 (21:24 -0700)]
resolved conflicts for merge of
c86eae32 to klp-modular-dev
Change-Id: I127912aed9c9e57a985c46bee13d111e159d2c6f
Nick Kralevich [Tue, 11 Aug 2015 03:31:38 +0000 (03:31 +0000)]
am
9d9491f9: am
0dbd0d7b: am
c9924410: am
2fe61ed0: am
3b8d3fa0: am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
9d9491f9fb83523cfe68f2aa26c14f72f70812fc':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 03:24:13 +0000 (03:24 +0000)]
am
0dbd0d7b: am
c9924410: am
2fe61ed0: am
3b8d3fa0: am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
0dbd0d7bfe340ac46271c7f87969431b62a023ed':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 03:07:29 +0000 (03:07 +0000)]
am
c9924410: am
2fe61ed0: am
3b8d3fa0: am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
c99244105803ac32f4cc698b5b2a85b225d925a2':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:57:48 +0000 (02:57 +0000)]
am
2fe61ed0: am
3b8d3fa0: am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
2fe61ed032e083dc39265f3b88274fcb8fbeed9b':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:49:10 +0000 (02:49 +0000)]
am
3b8d3fa0: am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
3b8d3fa0dd97c05f77c4686986812e40203678d2':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:37:17 +0000 (02:37 +0000)]
am
186d1fb9: am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
186d1fb9b72439c1c3317d72e4a0f52f466e6861':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:32:49 +0000 (02:32 +0000)]
am
f4dfe12e: am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
f4dfe12ecd26e7d6965a2abc062709b6d7d942c4':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:26:38 +0000 (02:26 +0000)]
am
54d88fe2: am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
54d88fe2f17b1c5c6e4d0d1d1e36089fea3a1df0':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Tue, 11 Aug 2015 02:20:00 +0000 (02:20 +0000)]
am
aa8dab77: Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
* commit '
aa8dab77aa9ef1bb6e5414ee5e773001de725bef':
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 17:01:56 +0000 (17:01 +0000)]
am
ba34c2ba: am
f59348ed: am
0080e03e: am
3ebcce0e: am
2c0f9591: am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
ba34c2ba414352ed0c1b9188f51c5445b04af2c6':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:55:57 +0000 (16:55 +0000)]
am
f59348ed: am
0080e03e: am
3ebcce0e: am
2c0f9591: am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
f59348edfc54baa8f6e6532c6484656cf444d199':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:41:15 +0000 (16:41 +0000)]
am
0080e03e: am
3ebcce0e: am
2c0f9591: am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
0080e03e2a69dcb5ecbcb2848f358ca73163714c':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:34:15 +0000 (16:34 +0000)]
am
3ebcce0e: am
2c0f9591: am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
3ebcce0e3fda1ffae9453ca0cc389ee852e1d0a2':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:23:51 +0000 (16:23 +0000)]
am
2c0f9591: am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
2c0f959112a1d9048e8dc527f2f9dc0cc3e490c9':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:16:08 +0000 (16:16 +0000)]
am
fea5921b: am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
fea5921b975cf43c88b8f93d4f2500abde6088be':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:08:43 +0000 (16:08 +0000)]
am
9fff1d37: am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
9fff1d37d6129dfce7a6f89004ec4a9cea9c9cad':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 16:01:24 +0000 (16:01 +0000)]
am
d9d35098: am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
d9d35098aaaa546d79d0707734aac9b4b12c5be1':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 15:19:26 +0000 (15:19 +0000)]
am
af6b3a6b: am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
af6b3a6bc44e65e6dbf95c1e5dadf76aa78018d9':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Sat, 8 Aug 2015 14:55:23 +0000 (14:55 +0000)]
Merge "MPEG4Extractor.cpp: Add check for size == SIZE_MAX" into jb-dev
Marco Nelissen [Sat, 8 Aug 2015 02:52:55 +0000 (02:52 +0000)]
am
80c17e0d: am
450e1015: Fix Ogg album art
* commit '
80c17e0d42248053edf7243e026995fefcf6aabd':
Fix Ogg album art
Marco Nelissen [Sat, 8 Aug 2015 02:47:04 +0000 (02:47 +0000)]
am
450e1015: Fix Ogg album art
* commit '
450e1015b7939292ca988dd1b4f0303a094478e9':
Fix Ogg album art
Marco Nelissen [Sat, 8 Aug 2015 01:17:58 +0000 (01:17 +0000)]
am
9c67741f: am
2e637bfd: Merge "Extra sanity checks on sample size and resolution" into klp-dev
* commit '
9c67741f9f7ccc1007c7ecb44b8037210c733723':
Extra sanity checks on sample size and resolution
Marco Nelissen [Sat, 8 Aug 2015 01:12:33 +0000 (01:12 +0000)]
am
2e637bfd: Merge "Extra sanity checks on sample size and resolution" into klp-dev
* commit '
2e637bfd64c59200414130671e32e3e087e9f147':
Extra sanity checks on sample size and resolution
Marco Nelissen [Thu, 6 Aug 2015 15:03:47 +0000 (08:03 -0700)]
Fix Ogg album art
Bug:
23036083
Bug: https://code.google.com/p/android/issues/detail?id=182053
Change-Id: I1a5cbe06990900160c2addade238c1e9feab8f71
(cherry picked from commit
c63cc509404b9328aedd1be3adc4e87cd07b4eb1)
Marco Nelissen [Sat, 8 Aug 2015 00:59:49 +0000 (00:59 +0000)]
Merge "Extra sanity checks on sample size and resolution" into klp-dev
Nick Kralevich [Fri, 7 Aug 2015 23:09:03 +0000 (23:09 +0000)]
am
bce77a36: am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
bce77a36125b25ce864b40bd5938ca89becea898':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Fri, 7 Aug 2015 18:41:28 +0000 (18:41 +0000)]
am
0e20b209: MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
* commit '
0e20b2093aa2bbc93afed8d68d3765d18a431b74':
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
Nick Kralevich [Fri, 7 Aug 2015 18:19:24 +0000 (11:19 -0700)]
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX
chunk_size is a uint64_t, so it can legitimately be bigger
than SIZE_MAX, which would cause the subtraction to underflow.
https://code.google.com/p/android/issues/detail?id=182251
Bug:
23034759
Change-Id: Ic1637fb26bf6edb0feb1bcf2876fd370db1ed547
Joshua J. Drake [Fri, 7 Aug 2015 17:44:05 +0000 (17:44 +0000)]
am
276cec63: am
4254be9a: am
9364bdc9: am
905aae46: am
11c88f66: am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
276cec63624d198981b37a68cd969031e4f42096':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 17:44:02 +0000 (17:44 +0000)]
am
f13cc52d: am
8e0e43d2: am
3621c056: am
bcc8e581: am
bb99a362: am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
f13cc52d3cab0a4dc0d0aac61507318589bd7545':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 17:44:01 +0000 (17:44 +0000)]
am
94012bc3: am
ffe509ff: am
d0af1ded: (-s ours) am
a421314f: am
430475da: resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
* commit '
94012bc3068816adf348bac7b1ffd477c6e34600':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Fri, 7 Aug 2015 17:38:06 +0000 (17:38 +0000)]
am
4254be9a: am
9364bdc9: am
905aae46: am
11c88f66: am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
4254be9a0d16bac995aa73d60e8e92839960bd32':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 17:38:05 +0000 (17:38 +0000)]
am
8e0e43d2: am
3621c056: am
bcc8e581: am
bb99a362: am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
8e0e43d2f6cd86888c8ab58303e5163809ec8b04':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 17:38:04 +0000 (17:38 +0000)]
am
ffe509ff: am
d0af1ded: (-s ours) am
a421314f: am
430475da: resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
* commit '
ffe509ffb243462597eb018a623241739d032be1':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Fri, 7 Aug 2015 17:19:23 +0000 (17:19 +0000)]
am
9364bdc9: am
905aae46: am
11c88f66: am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
9364bdc9a1298a609eb825be051c393cbf3d7a38':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 17:19:22 +0000 (17:19 +0000)]
am
3621c056: am
bcc8e581: am
bb99a362: am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
3621c05605c5a3f2c452668beacb71a08dc2d7c8':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 17:19:20 +0000 (17:19 +0000)]
am
d0af1ded: (-s ours) am
a421314f: am
430475da: resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
* commit '
d0af1dedf5d903a52fac58f694b3f8edbf20e656':
Prevent integer overflow when processing covr MPEG4 atoms
Nick Kralevich [Fri, 7 Aug 2015 17:02:37 +0000 (10:02 -0700)]
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
If size == SIZE_MAX, the line:
uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
ends up allocating zero bytes, which is obviously incorrect.
This is conceptually a cherrypick of commit
b2d33aee5122c91a59c2a676c0b89ad340232450 , but specifically for
Android 4.1 through Android 4.4. In Android 5.0, new code
was introduced which caused the function parseMetaData()
to be renamed.
Bug:
23031033
Change-Id: Ib34e740f3292a484f8a24e513c1cce58f2f33ecb
Joshua J. Drake [Fri, 7 Aug 2015 16:29:36 +0000 (16:29 +0000)]
am
905aae46: am
11c88f66: am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
905aae465fa88d6d793c670c08c360900c6cb3f7':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 16:29:35 +0000 (16:29 +0000)]
am
bcc8e581: am
bb99a362: am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
bcc8e5817fa3dc624f214e58f756098053ac5682':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 16:29:34 +0000 (16:29 +0000)]
am
a421314f: am
430475da: resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
* commit '
a421314f9cc1b061d94a79e2aa1a92916ea4b9bf':
Prevent integer overflow when processing covr MPEG4 atoms
Nick Kralevich [Mon, 3 Aug 2015 22:44:45 +0000 (15:44 -0700)]
MPEG4Extractor.cpp: Add check for size == SIZE_MAX
If size == SIZE_MAX, the line:
uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
ends up allocating zero bytes, which is obviously incorrect.
(cherry picked from commit
b2d33aee5122c91a59c2a676c0b89ad340232450)
Bug:
23031033
Change-Id: I8027247a4e24d2c8a8b4eac88c3643eccda108b9
Joshua J. Drake [Fri, 7 Aug 2015 16:17:11 +0000 (16:17 +0000)]
am
11c88f66: am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
11c88f66205dd9095cbe87f3486ef7262e4d2e22':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 16:17:10 +0000 (16:17 +0000)]
am
bb99a362: am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
bb99a362dc76f9bf040f6256369fabf27ad1c2f5':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 16:13:44 +0000 (16:13 +0000)]
am
430475da: resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
* commit '
430475da7f0edb86ee6a85378d1583ab07f7f93d':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Fri, 7 Aug 2015 16:11:07 +0000 (16:11 +0000)]
am
2796ba1c: am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
2796ba1c511517a4904d10d1fdc830c86d161342':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Fri, 7 Aug 2015 16:11:05 +0000 (16:11 +0000)]
am
8d60fc3e: am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
8d60fc3e3ecd4d7c2b18f25962f0ea42f3644ebd':
Fix integer overflow when handling MPEG4 tx3g atom
Nick Kralevich [Fri, 7 Aug 2015 15:50:46 +0000 (08:50 -0700)]
resolved conflicts for merge of
0b3eca88 to jb-mr1-dev-plus-aosp
Bug:
20923261
Change-Id: I6fe12a7c5768f77454bd0391b07f4c3181607d14
Marco Nelissen [Fri, 7 Aug 2015 14:32:40 +0000 (14:32 +0000)]
am
d6ea7f65: am
f26400c9: Fix crash on malformed id3
* commit '
d6ea7f65dd31d5dacf497cc3c494d4fa3910f7c3':
Fix crash on malformed id3
Marco Nelissen [Fri, 7 Aug 2015 14:25:10 +0000 (14:25 +0000)]
am
f26400c9: Fix crash on malformed id3
* commit '
f26400c9d01a0e2f71690d5ebc644270f098d590':
Fix crash on malformed id3
Marco Nelissen [Tue, 4 Aug 2015 15:38:24 +0000 (08:38 -0700)]
Extra sanity checks on sample size and resolution
Instead of rejecting the samples later when they don't fit in the
buffer, reject the entire file early.
Bug:
22882938
Change-Id: I748153b0e9e827e3f2526468756295b4b5000de6
(cherry picked from commit
beef7e58c1f1837bdaed6ac37414d8c48a133813)
Marco Nelissen [Tue, 4 Aug 2015 23:49:28 +0000 (16:49 -0700)]
Fix crash on malformed id3
Bug:
22954006
Change-Id: I488cb1e2c69fc7043b6040481b30fa866000515d
Joshua J. Drake [Tue, 4 Aug 2015 21:42:34 +0000 (21:42 +0000)]
am
a555788d: am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
a555788d9cd4a22a8f5d7dccd288f7d185cef209':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Tue, 4 Aug 2015 21:42:34 +0000 (21:42 +0000)]
am
338bbf53: am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
338bbf53be077a99f532e813d4cf14a192c55f74':
Fix integer overflow when handling MPEG4 tx3g atom
Joshua J. Drake [Tue, 4 Aug 2015 21:42:33 +0000 (21:42 +0000)]
am
cd5cf679: am
df1ecfe3: am
52d1defc: am
9481a101: am
a81b3779: Prevent integer overflow when processing covr MPEG4 atoms
* commit '
cd5cf6797c26ca7d3ce2f9a379bdef099dae2aae':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Tue, 4 Aug 2015 21:37:01 +0000 (21:37 +0000)]
am
0e33cb2d: am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
0e33cb2dd5ccf6f4db8c694cb2c233bb1d2a2d0b':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Tue, 4 Aug 2015 21:37:00 +0000 (21:37 +0000)]
am
fd334e34: am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
fd334e346bd0fc9b11756539d1635eabdb6b04cb':
Fix integer overflow when handling MPEG4 tx3g atom
Joshua J. Drake [Tue, 4 Aug 2015 21:36:59 +0000 (21:36 +0000)]
am
df1ecfe3: am
52d1defc: am
9481a101: am
a81b3779: Prevent integer overflow when processing covr MPEG4 atoms
* commit '
df1ecfe3913b9c3bce17947d877498093a42a56f':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Tue, 4 Aug 2015 21:31:51 +0000 (21:31 +0000)]
am
e4ccf3a1: am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
e4ccf3a14beabfeeb6c7df47ae118f3db999c1ce':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Tue, 4 Aug 2015 21:31:40 +0000 (21:31 +0000)]
am
03d539a7: am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
03d539a7a9c8ae7aef9cb8bda9042187327566a2':
Fix integer overflow when handling MPEG4 tx3g atom
Joshua J. Drake [Tue, 4 Aug 2015 21:31:38 +0000 (21:31 +0000)]
am
52d1defc: am
9481a101: am
a81b3779: Prevent integer overflow when processing covr MPEG4 atoms
* commit '
52d1defcfe51bd3b5f4e191fb70a0a0a406c33dc':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Tue, 4 Aug 2015 21:25:41 +0000 (21:25 +0000)]
am
3329a19b: am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
3329a19b4d11d3c1310bbe9aa54b6a66488ab862':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Tue, 4 Aug 2015 21:25:40 +0000 (21:25 +0000)]
am
a5b9055d: am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
a5b9055d7ce1d82ee29ed2f45aa4f8a82ccc76f2':
Fix integer overflow when handling MPEG4 tx3g atom
Joshua J. Drake [Tue, 4 Aug 2015 21:25:38 +0000 (21:25 +0000)]
am
9481a101: am
a81b3779: Prevent integer overflow when processing covr MPEG4 atoms
* commit '
9481a101f8246263d969af66a7b39fad7346772e':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Tue, 4 Aug 2015 21:18:33 +0000 (21:18 +0000)]
am
c87faed6: Fix integer underflow in covr MPEG4 processing
* commit '
c87faed60483afb2466e03892bda80b72e5822c7':
Fix integer underflow in covr MPEG4 processing
Joshua J. Drake [Tue, 4 Aug 2015 21:18:32 +0000 (21:18 +0000)]
am
f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit '
f1ce97ddc2f82d844a6fb8341585eb7b2e655f44':
Fix integer overflow when handling MPEG4 tx3g atom
Joshua J. Drake [Tue, 4 Aug 2015 21:18:30 +0000 (21:18 +0000)]
am
a81b3779: Prevent integer overflow when processing covr MPEG4 atoms
* commit '
a81b3779cc6f6046c8a9149bf544e9d726c9b2b2':
Prevent integer overflow when processing covr MPEG4 atoms
Joshua J. Drake [Mon, 4 May 2015 22:14:11 +0000 (17:14 -0500)]
Fix integer underflow in covr MPEG4 processing
When the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an
integer underflow can occur. This causes an extraordinarily large value to
be passed to MetaData::setData, leading to a buffer overflow.
Bug:
20923261
(cherry picked from commit
4a492bf2ac47b9844d2527e1fcdf0064c3d8d52e)
Change-Id: I83490cbaf5b368073fcd8668a9241dfc90bebd90
Joshua J. Drake [Mon, 4 May 2015 23:29:08 +0000 (18:29 -0500)]
Fix integer overflow when handling MPEG4 tx3g atom
When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.
Bug:
20923261
(cherry picked from commit
e5f0966c76bd0a7e81e4205c8d8b55e6b34c833e)
Change-Id: I3f240f75fd681becbf89cb7e7554388471c28059
Joshua J. Drake [Mon, 4 May 2015 23:36:35 +0000 (18:36 -0500)]
Prevent integer overflow when processing covr MPEG4 atoms
If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur
and cause an undersized buffer to be allocated. The following processing
then overfills the resulting memory and creates a potentially exploitable
condition. Ensure that integer overflow does not occur.
(cherrypicked from commit
05ddc499b9d50c90f552ed1333110f28a1406e7c)
Bug:
20923261
Change-Id: If09a02738759acdff8d95149bb9cb5f18a0a123e
Wei Jia [Tue, 4 Aug 2015 18:28:58 +0000 (18:28 +0000)]
am
42bd61d7: am
d9a9a324: am
10ef7f75: am
b0924c63: am
7af634e1: am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
42bd61d73e8b4d0b1101e73324a59fde51077112':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 18:19:37 +0000 (18:19 +0000)]
am
d9a9a324: am
10ef7f75: am
b0924c63: am
7af634e1: am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
d9a9a324766b26be2ff0d10537ea0b215b0261e3':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 18:00:56 +0000 (18:00 +0000)]
am
10ef7f75: am
b0924c63: am
7af634e1: am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
10ef7f7514bdf6d9c38c93d9bb0194c0920d152f':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 17:51:22 +0000 (17:51 +0000)]
am
b0924c63: am
7af634e1: am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
b0924c631cfccd10c1f95d6ae44c8cd852e14a9f':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 17:29:31 +0000 (17:29 +0000)]
am
7af634e1: am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
7af634e131361862d2e47fb344278e31ed05be4f':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 17:20:14 +0000 (17:20 +0000)]
am
8ec119d2: am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
8ec119d2f033221e4cb0fd2b2948e780581b3d35':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 17:09:44 +0000 (17:09 +0000)]
am
d138024f: am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
d138024f94fe01934be700ce16aa84418fbe1827':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 16:59:31 +0000 (16:59 +0000)]
am
b32957db: am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
b32957dbf4527251ad3b2bbda4ccc5fff4df0718':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 16:54:23 +0000 (16:54 +0000)]
am
a9d7c917: am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
a9d7c917d3a76d0bef9b8afe7ade206534be68a4':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 16:47:48 +0000 (16:47 +0000)]
am
a99d3d83: am
738a753a: SampleTable: fix integer overflow checks.
* commit '
a99d3d8327d60c8f8ef3e34fc4b81ef382e9e6d2':
SampleTable: fix integer overflow checks.
Wei Jia [Tue, 4 Aug 2015 16:40:31 +0000 (16:40 +0000)]
am
738a753a: SampleTable: fix integer overflow checks.
* commit '
738a753a3ca7bf8f9f608ca941575626265294e4':
SampleTable: fix integer overflow checks.
Joshua J. Drake [Tue, 4 Aug 2015 05:38:27 +0000 (05:38 +0000)]
am
98ee4c01: am
712090a6: am
cfc12112: am
ac7cb990: am
b417986c: am
d1c08d6b: am
efa73c2e: am
2e24d091: am
a59d5e66: am
8ef5da3d: am
4dd7cb69: Fix integer underflow in ESDS processing
* commit '
98ee4c01d3843c1973c399404b7166431eadedb9':
Fix integer underflow in ESDS processing
Joshua J. Drake [Tue, 4 Aug 2015 05:38:25 +0000 (05:38 +0000)]
am
10f6b17a: am
d053da7b: am
a9f1e993: am
134dc311: am
80a6d9f3: am
e10c2e62: am
74ebcd65: am
272f4056: am
52302d91: am
f354c48e: am
5c4428f6: Fix integer overflow during MP4 atom processing
* commit '
10f6b17a29f7d39303b4779929d15c540ee87290':
Fix integer overflow during MP4 atom processing
Joshua J. Drake [Tue, 4 Aug 2015 05:38:23 +0000 (05:38 +0000)]
am
63e7ae97: am
45c12368: am
b77a6189: am
4837e90f: am
9c5578c1: am
36617c67: am
7374360f: am
4e44b2ee: am
4534ec1a: am
4a5fbf74: am
3cc11bfc: Fix several ineffective integer overflow checks
* commit '
63e7ae97369bf8b06337c51f8287654a94d11076':
Fix several ineffective integer overflow checks
Wei Jia [Thu, 4 Jun 2015 17:40:23 +0000 (10:40 -0700)]
SampleTable: fix integer overflow checks.
Bug:
20139950
Bug:
22935234
(cherry picked from commit
a105482ae577852ffd08ce88ae5d1ba81db875ac)
Change-Id: I408d261de1a6dd5c4343bcf3a7dfd8a259e0e2f3
Joshua J. Drake [Tue, 4 Aug 2015 05:30:59 +0000 (05:30 +0000)]
am
712090a6: am
cfc12112: am
ac7cb990: am
b417986c: am
d1c08d6b: am
efa73c2e: am
2e24d091: am
a59d5e66: am
8ef5da3d: am
4dd7cb69: Fix integer underflow in ESDS processing
* commit '
712090a60253a2879e0c7d21a33f43534ffb51fc':
Fix integer underflow in ESDS processing
Joshua J. Drake [Tue, 4 Aug 2015 05:30:58 +0000 (05:30 +0000)]
am
d053da7b: am
a9f1e993: am
134dc311: am
80a6d9f3: am
e10c2e62: am
74ebcd65: am
272f4056: am
52302d91: am
f354c48e: am
5c4428f6: Fix integer overflow during MP4 atom processing
* commit '
d053da7b4bb60290bf51052cc7abe070fd819479':
Fix integer overflow during MP4 atom processing
Joshua J. Drake [Tue, 4 Aug 2015 05:30:57 +0000 (05:30 +0000)]
am
45c12368: am
b77a6189: am
4837e90f: am
9c5578c1: am
36617c67: am
7374360f: am
4e44b2ee: am
4534ec1a: am
4a5fbf74: am
3cc11bfc: Fix several ineffective integer overflow checks
* commit '
45c12368f1ced4c6783195432fdffdc7a3e36cca':
Fix several ineffective integer overflow checks
Joshua J. Drake [Tue, 4 Aug 2015 04:55:58 +0000 (04:55 +0000)]
am
cfc12112: am
ac7cb990: am
b417986c: am
d1c08d6b: am
efa73c2e: am
2e24d091: am
a59d5e66: am
8ef5da3d: am
4dd7cb69: Fix integer underflow in ESDS processing
* commit '
cfc121128aef10a98e5ad9162f43e3f368abd103':
Fix integer underflow in ESDS processing
Joshua J. Drake [Tue, 4 Aug 2015 04:55:55 +0000 (04:55 +0000)]
am
a9f1e993: am
134dc311: am
80a6d9f3: am
e10c2e62: am
74ebcd65: am
272f4056: am
52302d91: am
f354c48e: am
5c4428f6: Fix integer overflow during MP4 atom processing
* commit '
a9f1e993fa7849bc658d89a2faa58344faa88a5f':
Fix integer overflow during MP4 atom processing
OSDN Git Service
