OSDN Git Service

android-x86/frameworks-av.git
7 years agoFix integer overflow in mediadrmserver
Jeff Tinker [Tue, 6 Jun 2017 19:05:36 +0000 (19:05 +0000)]
Fix integer overflow in mediadrmserver
am: eb21712f81

Change-Id: I0caf94590f85f444a4705f62792c27a447fa8b69

7 years agoFix integer overflow in mediadrmserver
Jeff Tinker [Mon, 5 Jun 2017 21:34:48 +0000 (14:34 -0700)]
Fix integer overflow in mediadrmserver

bug:37710346
Change-Id: If18cfb5bb1d1f1b2997d2a0e1685590d674181f4

7 years agoMerge "Fix potential leak" into klp-dev am: 2f9eacc3ae am: a7602f8339 am: fe7c2700ae
Marco Nelissen [Fri, 2 Jun 2017 04:15:32 +0000 (04:15 +0000)]
Merge "Fix potential leak" into klp-dev am: 2f9eacc3ae am: a7602f8339 am: fe7c2700ae
am: cbaad4b189

Change-Id: Ifd9897d7c631c92e756481c3f43f0b4cbca85ca0

7 years agoMerge "Fix potential leak" into klp-dev am: 2f9eacc3ae am: a7602f8339
Marco Nelissen [Fri, 2 Jun 2017 04:12:32 +0000 (04:12 +0000)]
Merge "Fix potential leak" into klp-dev am: 2f9eacc3ae am: a7602f8339
am: fe7c2700ae

Change-Id: I9c4c5dbe0682992f9e7521ed3bf6a52d8311e00f

7 years agoMerge "Fix potential leak" into klp-dev am: 2f9eacc3ae
Marco Nelissen [Fri, 2 Jun 2017 04:09:21 +0000 (04:09 +0000)]
Merge "Fix potential leak" into klp-dev am: 2f9eacc3ae
am: a7602f8339

Change-Id: I2883ac8221475d5fa73ed34350f199355b541b14

7 years agoMerge "Fix potential leak" into klp-dev
Marco Nelissen [Fri, 2 Jun 2017 04:05:59 +0000 (04:05 +0000)]
Merge "Fix potential leak" into klp-dev
am: 2f9eacc3ae

Change-Id: I7e3a53be249eff99dd895e500f9833ad55a184b0

7 years agoMerge "Fix potential leak" into klp-dev
TreeHugger Robot [Fri, 2 Jun 2017 04:02:09 +0000 (04:02 +0000)]
Merge "Fix potential leak" into klp-dev

7 years agoMerge "Fix memory leak in error case" into klp-dev am: 5136b7436f am: 60657857c6...
Marco Nelissen [Tue, 16 May 2017 15:36:54 +0000 (15:36 +0000)]
Merge "Fix memory leak in error case" into klp-dev am: 5136b7436f am: 60657857c6 am: 55057ab408
am: a2fbd251ca

Change-Id: I8a0e99463feb24350f02d5b5ccdc9419ebb2d71d

7 years agoMerge "Fix memory leak in error case" into klp-dev am: 5136b7436f am: 60657857c6
Marco Nelissen [Tue, 16 May 2017 15:33:25 +0000 (15:33 +0000)]
Merge "Fix memory leak in error case" into klp-dev am: 5136b7436f am: 60657857c6
am: 55057ab408

Change-Id: I5107a57def4be19aad9dca950cca06bebecad1e8

7 years agoMerge "Fix memory leak in error case" into klp-dev am: 5136b7436f
Marco Nelissen [Tue, 16 May 2017 15:30:24 +0000 (15:30 +0000)]
Merge "Fix memory leak in error case" into klp-dev am: 5136b7436f
am: 60657857c6

Change-Id: I1564d4e2626a31b7018bae301c50a268ccc79749

7 years agoMerge "Fix memory leak in error case" into klp-dev
Marco Nelissen [Tue, 16 May 2017 15:27:25 +0000 (15:27 +0000)]
Merge "Fix memory leak in error case" into klp-dev
am: 5136b7436f

Change-Id: I479e015461fa46227c4cae49829b0f3c0d769de9

7 years agoMerge "Fix memory leak in error case" into klp-dev
Marco Nelissen [Tue, 16 May 2017 15:20:59 +0000 (15:20 +0000)]
Merge "Fix memory leak in error case" into klp-dev

7 years agoLimit ogg packet size am: bf928560ac am: f349435fcf am: 086cee9d89
Marco Nelissen [Mon, 15 May 2017 16:59:57 +0000 (16:59 +0000)]
Limit ogg packet size am: bf928560ac am: f349435fcf am: 086cee9d89
am: b65b0a8367

Change-Id: I2faa1a87e934851ee2a4a865e3e3d7084381dac6

7 years agoLimit ogg packet size am: bf928560ac am: f349435fcf
Marco Nelissen [Mon, 15 May 2017 16:56:55 +0000 (16:56 +0000)]
Limit ogg packet size am: bf928560ac am: f349435fcf
am: 086cee9d89

Change-Id: I9687649ed25dade9f872c83a290bbcd0abb4b5fc

7 years agoLimit ogg packet size am: bf928560ac
Marco Nelissen [Mon, 15 May 2017 16:53:54 +0000 (16:53 +0000)]
Limit ogg packet size am: bf928560ac
am: f349435fcf

Change-Id: I952944295017f01b254c80c8db935e33c51337f3

7 years agoLimit ogg packet size
Marco Nelissen [Mon, 15 May 2017 16:50:55 +0000 (16:50 +0000)]
Limit ogg packet size
am: bf928560ac

Change-Id: I102f6e9b1b4933d043b2a3e1e3f7fc885aaf6779

7 years agoLimit ogg packet size
Marco Nelissen [Fri, 12 May 2017 22:35:30 +0000 (15:35 -0700)]
Limit ogg packet size

A malformed ogg file might lace together a very large packet, which
could lead to out of memory conditions. Limit the packet size to
avoid this.

Bug: 36592202
Change-Id: I8650b3ec54a0de9ec302a7cbac296bb85efcfb3d

7 years agoFix memory leak in error case
Marco Nelissen [Fri, 12 May 2017 17:45:14 +0000 (10:45 -0700)]
Fix memory leak in error case

Bug: 37239013
Change-Id: Ic33e0f7ed946d0729efa46f69aff1a5d35e81b1e

7 years agoFix potential leak
Marco Nelissen [Tue, 9 May 2017 21:17:06 +0000 (14:17 -0700)]
Fix potential leak

Fix potential memory leak introduced with bugfix for bug 31449945.

Bug: 36389123
Change-Id: I5a9a3551692d6cba385b45c4c7a465aa377a62b1

7 years agoMerge "Avoid crash for stss sync sample number 0" into lmp-dev
Roger1 Jonsson [Tue, 11 Apr 2017 17:22:19 +0000 (17:22 +0000)]
Merge "Avoid crash for stss sync sample number 0" into lmp-dev
am: d12204372f

Change-Id: Ic2bca43957197cf537760826de60fcb85777cb1b

7 years agoMerge "Avoid crash for stss sync sample number 0" into lmp-dev
TreeHugger Robot [Tue, 11 Apr 2017 17:02:45 +0000 (17:02 +0000)]
Merge "Avoid crash for stss sync sample number 0" into lmp-dev

7 years agoMerge "Don't allow using or allocating a buffer after the first state transition...
Marco Nelissen [Mon, 10 Apr 2017 20:41:04 +0000 (20:41 +0000)]
Merge "Don't allow using or allocating a buffer after the first state transition" into klp-dev am: 922ad6183e am: 0893c50bcf am: 59bc7f77f8
am: 82ffcbd667

Change-Id: I1b2ea29d1c22f1714f0c0e90a56c585176742dd2

7 years agoMerge "Don't allow using or allocating a buffer after the first state transition...
Marco Nelissen [Mon, 10 Apr 2017 20:36:33 +0000 (20:36 +0000)]
Merge "Don't allow using or allocating a buffer after the first state transition" into klp-dev am: 922ad6183e am: 0893c50bcf
am: 59bc7f77f8

Change-Id: I133f8566b649821e06cfb21a95b20f84eb839219

7 years agoMerge "Don't allow using or allocating a buffer after the first state transition...
Marco Nelissen [Mon, 10 Apr 2017 20:32:06 +0000 (20:32 +0000)]
Merge "Don't allow using or allocating a buffer after the first state transition" into klp-dev am: 922ad6183e
am: 0893c50bcf

Change-Id: I819b55a95ff50c51488bac50c43fea8b2244a410

7 years agoMerge "Don't allow using or allocating a buffer after the first state transition...
Marco Nelissen [Mon, 10 Apr 2017 20:27:43 +0000 (20:27 +0000)]
Merge "Don't allow using or allocating a buffer after the first state transition" into klp-dev
am: 922ad6183e

Change-Id: I8fbd67b5fe298d6f842d224109e2ab0b52a2b59a

7 years agoMerge "Don't allow using or allocating a buffer after the first state transition...
Marco Nelissen [Mon, 10 Apr 2017 19:57:08 +0000 (19:57 +0000)]
Merge "Don't allow using or allocating a buffer after the first state transition" into klp-dev

7 years agoAvoid crash for stss sync sample number 0 am: 5c364997a3 am: e77a32bd3d am: ab28d49e4...
Roger1 Jonsson [Wed, 5 Apr 2017 23:10:38 +0000 (23:10 +0000)]
Avoid crash for stss sync sample number 0 am: 5c364997a3 am: e77a32bd3d am: ab28d49e41  -s ours
am: 73db408aa3

Change-Id: Ibe55680e73e9caddc3fc79883fa17a50742f393d

7 years agoAvoid crash for stss sync sample number 0
Roger1 Jonsson [Wed, 26 Oct 2016 07:20:00 +0000 (09:20 +0200)]
Avoid crash for stss sync sample number 0

A sample number value of 0 means that the value stored in
the mSyncSamples array, would become negative (-1),
when converted to index value. This causes a crash.

Make sure that stss sample numbers are bigger
than 0 before converting sample number to index value.

Bug: 32423862
bug: 35645051
Test: Playback video that triggers stss sync sample number 0
Change-Id: I35bee7c718e01b086d7e05deda13b38083f509f5

7 years agoAvoid crash for stss sync sample number 0 am: 5c364997a3 am: e77a32bd3d
Roger1 Jonsson [Wed, 5 Apr 2017 23:07:37 +0000 (23:07 +0000)]
Avoid crash for stss sync sample number 0 am: 5c364997a3 am: e77a32bd3d
am: ab28d49e41  -s ours

Change-Id: I63e6f4ea65dda85e5d779f6aaf1fbd4ca5806f8c

7 years agoAvoid crash for stss sync sample number 0 am: 5c364997a3
Roger1 Jonsson [Wed, 5 Apr 2017 22:52:35 +0000 (22:52 +0000)]
Avoid crash for stss sync sample number 0 am: 5c364997a3
am: e77a32bd3d

Change-Id: If61ba19bc937c6b7c7227296ddba5a1797072f9d

7 years agoAvoid crash for stss sync sample number 0
Roger1 Jonsson [Wed, 5 Apr 2017 22:49:34 +0000 (22:49 +0000)]
Avoid crash for stss sync sample number 0
am: 5c364997a3

Change-Id: Ia97daf543c65b52db1c5d09471ed8d00a434364d

7 years agoAvoid crash for stss sync sample number 0
Roger1 Jonsson [Wed, 26 Oct 2016 07:20:00 +0000 (09:20 +0200)]
Avoid crash for stss sync sample number 0

A sample number value of 0 means that the value stored in
the mSyncSamples array, would become negative (-1),
when converted to index value. This causes a crash.

Make sure that stss sample numbers are bigger
than 0 before converting sample number to index value.

Bug: 32423862
bug: 35645051
Test: Playback video that triggers stss sync sample number 0
Change-Id: I35bee7c718e01b086d7e05deda13b38083f509f5

7 years agoDon't allow using or allocating a buffer after the first state transition
Marco Nelissen [Mon, 27 Mar 2017 22:04:25 +0000 (15:04 -0700)]
Don't allow using or allocating a buffer after the first state transition

Bug: 35467458
Change-Id: Ia76c8cec8ad2abb95ca29b2a89075f7acab4b174

7 years agoDO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0 am: 761abda1bd...
Robert Shih [Tue, 14 Mar 2017 23:58:59 +0000 (23:58 +0000)]
DO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0 am: 761abda1bd am: aca26c9d45  -s ours
am: 1e4d8d67bc  -s ours

Change-Id: Iab0b678707ea31ad02f0f9be5f02f5638c601826

7 years agoFLACExtractor: copy protect mWriteBuffer
Robert Shih [Tue, 14 Mar 2017 23:55:10 +0000 (23:55 +0000)]
FLACExtractor: copy protect mWriteBuffer
am: 8ee699977c

Change-Id: Icdfd99c85fb0f76cc607f8bb29430913cf72bad1

7 years agoDO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0 am: 761abda1bd
Robert Shih [Tue, 14 Mar 2017 23:54:28 +0000 (23:54 +0000)]
DO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0 am: 761abda1bd
am: aca26c9d45  -s ours

Change-Id: Id436554a36de729ccd7a3220e32e155c423d0531

7 years agoDO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0
Robert Shih [Tue, 14 Mar 2017 23:49:57 +0000 (23:49 +0000)]
DO NOT MERGE FLACExtractor: copy protect mWriteBuffer am: 13c77f4fe0
am: 761abda1bd

Change-Id: I30bf5233b69619d260edb952248865adf5c55c83

7 years agoDO NOT MERGE FLACExtractor: copy protect mWriteBuffer
Robert Shih [Tue, 14 Mar 2017 23:45:27 +0000 (23:45 +0000)]
DO NOT MERGE FLACExtractor: copy protect mWriteBuffer
am: 13c77f4fe0

Change-Id: Ib7f8b77b3ba27fcd8e61e540eb39259cb287185c

7 years agoFLACExtractor: copy protect mWriteBuffer
Robert Shih [Mon, 24 Oct 2016 18:38:31 +0000 (11:38 -0700)]
FLACExtractor: copy protect mWriteBuffer

Bug: 30895578
Bug: 34970788
Change-Id: I4cba36bbe3502678210e5925181683df9726b431
(cherry picked from commit 328cd66cc72ba7bc5452ed5a93f29ddcd73aa9f9)

7 years agoDO NOT MERGE FLACExtractor: copy protect mWriteBuffer
Robert Shih [Mon, 24 Oct 2016 18:38:31 +0000 (11:38 -0700)]
DO NOT MERGE FLACExtractor: copy protect mWriteBuffer

Bug: 30895578
Bug: 34970788
Change-Id: I4cba36bbe3502678210e5925181683df9726b431

7 years agoMerge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af...
Ray Essick [Mon, 13 Mar 2017 22:57:12 +0000 (22:57 +0000)]
Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752 am: 8e3cf4d841 am: 5b1bfc1f43
am: 8abf11b512

Change-Id: I1cdf8344d8ca41cf5c4b6622ec743bb094c3dff0

7 years agoMerge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f...
Ray Essick [Mon, 13 Mar 2017 22:56:57 +0000 (22:56 +0000)]
Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f am: dcda2ec2fe am: f5c7784dbd
am: c3de266a99

Change-Id: I38701178a3fd7632fc8717472338d60d4cb0de2e

7 years agoMerge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af...
Ray Essick [Mon, 13 Mar 2017 22:52:42 +0000 (22:52 +0000)]
Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752 am: 8e3cf4d841
am: 5b1bfc1f43

Change-Id: I32327162d3e69259656f0b3a82800f45572527fd

7 years agoMerge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f...
Ray Essick [Mon, 13 Mar 2017 22:52:28 +0000 (22:52 +0000)]
Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f am: dcda2ec2fe
am: f5c7784dbd

Change-Id: Ic1901b3fa14a1e1c7f582e5b7862e777489e7314

7 years agoMerge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0 am: bbca2...
Marco Nelissen [Mon, 13 Mar 2017 22:48:27 +0000 (22:48 +0000)]
Merge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0 am: bbca2719c6 am: c2e69851ea
am: 3285770d37

Change-Id: Id82c89fed96d3cfa11d68ba5d791d5a360aa243c

7 years agoMerge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e am: 9e8dfb5938 am: 9e4a0...
Marco Nelissen [Mon, 13 Mar 2017 22:48:12 +0000 (22:48 +0000)]
Merge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e am: 9e8dfb5938 am: 9e4a0e1fab
am: 3c4401fce8

Change-Id: Ib6bd99193a44fbd801906d234c42b3fa3d33fb9a

7 years agoMerge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752
Ray Essick [Mon, 13 Mar 2017 22:48:10 +0000 (22:48 +0000)]
Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752
am: 8e3cf4d841

Change-Id: I804c61a21202d3c5aef3edac5872f56cef67753b

7 years agoMerge "Fix out of bounds access" into klp-dev am: 360cbbd72c am: f71b76cae8 am: 36c2e...
Marco Nelissen [Mon, 13 Mar 2017 22:47:58 +0000 (22:47 +0000)]
Merge "Fix out of bounds access" into klp-dev am: 360cbbd72c am: f71b76cae8 am: 36c2e14da3
am: 8a3cc1963e

Change-Id: I72dd260e2ee0f9560c9322c3aaf7b93c8008607e

7 years agoMerge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f
Ray Essick [Mon, 13 Mar 2017 22:47:56 +0000 (22:47 +0000)]
Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev am: 2076915c5f
am: dcda2ec2fe

Change-Id: I6759f0d478dd70baf59c3e006cb904d26793c1d4

7 years agoMerge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0 am: bbca2...
Marco Nelissen [Mon, 13 Mar 2017 22:43:54 +0000 (22:43 +0000)]
Merge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0 am: bbca2719c6
am: c2e69851ea

Change-Id: I2720c4439848f9aab8d7fa4f93b548793d129a4f

7 years agoMerge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e am: 9e8dfb5938
Marco Nelissen [Mon, 13 Mar 2017 22:43:40 +0000 (22:43 +0000)]
Merge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e am: 9e8dfb5938
am: 9e4a0e1fab

Change-Id: I17a5c0765c31c92a25e7c89a330aa656adc03baf

7 years agoMerge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev
Ray Essick [Mon, 13 Mar 2017 22:43:39 +0000 (22:43 +0000)]
Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev
am: 19b91af752

Change-Id: I83ad1fa809b82d1b4a6158b66ebffc5ae1d35590

7 years agoMerge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev
Ray Essick [Mon, 13 Mar 2017 22:43:27 +0000 (22:43 +0000)]
Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev
am: 2076915c5f

Change-Id: Ib9bc5c92218231acefda2800df84a8bffe2da92f

7 years agoMerge "Fix out of bounds access" into klp-dev am: 360cbbd72c am: f71b76cae8
Marco Nelissen [Mon, 13 Mar 2017 22:43:26 +0000 (22:43 +0000)]
Merge "Fix out of bounds access" into klp-dev am: 360cbbd72c am: f71b76cae8
am: 36c2e14da3

Change-Id: Ie6d46a6979bc89e2485fa4d2a25b21fc601e9783

7 years agoMerge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0
Marco Nelissen [Mon, 13 Mar 2017 22:39:25 +0000 (22:39 +0000)]
Merge "Fix integer overflow and divide-by-zero" into klp-dev am: b264ece2c0
am: bbca2719c6

Change-Id: If5ae485e1be0df3d4f61edf689d5b4c1520077b8

7 years agoMerge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e
Marco Nelissen [Mon, 13 Mar 2017 22:39:10 +0000 (22:39 +0000)]
Merge "Fix NPDs in h263 decoder" into klp-dev am: 012e5fd39e
am: 9e8dfb5938

Change-Id: I875cb7bba1bc6f6f443923a04629ae44a9d41140

7 years agoMerge "Fix out of bounds access" into klp-dev am: 360cbbd72c
Marco Nelissen [Mon, 13 Mar 2017 22:38:56 +0000 (22:38 +0000)]
Merge "Fix out of bounds access" into klp-dev am: 360cbbd72c
am: f71b76cae8

Change-Id: I3306be5d7bb3867287732757dd14170527488b68

7 years agoMerge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev
Ray Essick [Mon, 13 Mar 2017 22:38:40 +0000 (22:38 +0000)]
Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev

7 years agoMerge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev
Ray Essick [Mon, 13 Mar 2017 22:35:43 +0000 (22:35 +0000)]
Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev

7 years agoMerge "Fix integer overflow and divide-by-zero" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:34:54 +0000 (22:34 +0000)]
Merge "Fix integer overflow and divide-by-zero" into klp-dev
am: b264ece2c0

Change-Id: Id65ef33cb965b6fbdec95d9429ee05b134fd14f3

7 years agoMerge "Fix NPDs in h263 decoder" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:34:40 +0000 (22:34 +0000)]
Merge "Fix NPDs in h263 decoder" into klp-dev
am: 012e5fd39e

Change-Id: I2ad3e1364472558cf48c51fb3e2a08002d74c32d

7 years agoMerge "Fix out of bounds access" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:34:26 +0000 (22:34 +0000)]
Merge "Fix out of bounds access" into klp-dev
am: 360cbbd72c

Change-Id: I9ea32d31b1281689c4b5997a6c328630031c1795

7 years agoMerge "Fix integer overflow and divide-by-zero" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:31:24 +0000 (22:31 +0000)]
Merge "Fix integer overflow and divide-by-zero" into klp-dev

7 years agoMerge "Fix NPDs in h263 decoder" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:30:25 +0000 (22:30 +0000)]
Merge "Fix NPDs in h263 decoder" into klp-dev

7 years agoMerge "Fix out of bounds access" into klp-dev
Marco Nelissen [Mon, 13 Mar 2017 22:28:40 +0000 (22:28 +0000)]
Merge "Fix out of bounds access" into klp-dev

7 years agoAdd bounds check in SoftAACEncoder2::onQueueFilled()
Ray Essick [Mon, 13 Mar 2017 18:59:57 +0000 (11:59 -0700)]
Add bounds check in SoftAACEncoder2::onQueueFilled()

Original code blindly copied some header information into the
user-supplied buffer without checking for sufficient space.
The code does check when it gets to filling the data -- it's
just the header copies that weren't checked.

Bug: 34617444
Test: ran POC before/after
Change-Id: I6e80ec90616f6cd02bb8316cd2d6e309b7e4729d

7 years agoFix NPDs in h263 decoder
Marco Nelissen [Fri, 3 Mar 2017 21:37:27 +0000 (13:37 -0800)]
Fix NPDs in h263 decoder

Bug: 35269635
Test: decoded PoC with and without patch
Change-Id: I636a14360c7801cc5bca63c9cb44d1d235df8fd8

7 years agoFix TOCTOU problem in libstagefright_soft_aacenc
Ray Essick [Sat, 11 Mar 2017 00:03:40 +0000 (16:03 -0800)]
Fix TOCTOU problem in libstagefright_soft_aacenc

Fixes a configuration error where we sized a buffer initially based
on the configuration at the time and held onto the buffer through the
rest of our lifetime. If the configuration was changed in a way that
resulted in needing a different size buffer, the code did not make
this happen.

Patch keeps the buffer around but also stores the 'current allocation
size'.  This allows the later code that preps the buffer to query if
the buffer size is same or changed.  If changed, we discard the old
buffer and allocate a new one of the appropriate size.

safetynet logging added so we can tell how often this happens in the
field.

Testing was done on nyc-mr2 (where poc was built). Patch applies
without change to k/l/m/n/master.

Bug: 34621073
Test: run POC, saw new diagnostics saying it caught the size change.
Change-Id: Ia95aadc8c727434b7ba9628deeae327c405336d3

7 years agoFix out of bounds access
Marco Nelissen [Fri, 10 Mar 2017 19:28:44 +0000 (11:28 -0800)]
Fix out of bounds access

Bug: 34618607
Change-Id: I84f0ef948414d0b2d54e8948b6c30b8ae4da2b36

7 years agoMerge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track"...
Andy Hung [Fri, 10 Mar 2017 22:42:59 +0000 (22:42 +0000)]
Merge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track" into klp-dev am: e0da30dc57 am: 737754e97a am: de6072164a  -s ours
am: 9fe1d60957  -s ours

Change-Id: I06683878d8e39e9d9dcae9f897124c36f6b968bf

7 years agoMerge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track"...
Andy Hung [Fri, 10 Mar 2017 22:39:58 +0000 (22:39 +0000)]
Merge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track" into klp-dev am: e0da30dc57 am: 737754e97a
am: de6072164a  -s ours

Change-Id: I33a81bea7f8e210dbadade3f9bd63a3decbfb478

7 years agoMerge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track"...
Andy Hung [Fri, 10 Mar 2017 22:36:28 +0000 (22:36 +0000)]
Merge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track" into klp-dev am: e0da30dc57
am: 737754e97a

Change-Id: Ide9fb3f4955a31ade22f99c299f441d8413c1b88

7 years agoMerge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track"...
Andy Hung [Fri, 10 Mar 2017 22:32:59 +0000 (22:32 +0000)]
Merge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track" into klp-dev
am: e0da30dc57

Change-Id: Ia8aee821949f27b81e5c0ddca2e39aa9e478a432

7 years agoMerge "AudioFlinger: Check framecount overflow when creating track" into lmp-dev
Andy Hung [Fri, 10 Mar 2017 22:32:59 +0000 (22:32 +0000)]
Merge "AudioFlinger: Check framecount overflow when creating track" into lmp-dev
am: 51a3483ec9

Change-Id: I6fe5fb0a7142218b16c84bc1966a84ac920fd70a

7 years agoMerge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track"...
Andy Hung [Fri, 10 Mar 2017 22:29:51 +0000 (22:29 +0000)]
Merge "DO NOT MERGE AudioFlinger: Check framecount overflow when creating track" into klp-dev

7 years agoMerge "AudioFlinger: Check framecount overflow when creating track" into lmp-dev
Andy Hung [Fri, 10 Mar 2017 22:29:43 +0000 (22:29 +0000)]
Merge "AudioFlinger: Check framecount overflow when creating track" into lmp-dev

7 years agoFix integer overflow and divide-by-zero
Marco Nelissen [Thu, 9 Mar 2017 23:01:55 +0000 (15:01 -0800)]
Fix integer overflow and divide-by-zero

Bug: 35763994
Test: ran CTS with and without fix
Change-Id: If835e97ce578d4fa567e33e349e48fb7b2559e0e

7 years agoDO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e am: afaa43850...
Wonsik Kim [Thu, 16 Feb 2017 01:38:20 +0000 (01:38 +0000)]
DO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e am: afaa438503 am: daaabdcaac  -s ours
am: da9246fa5e  -s ours

Change-Id: I72b4c927264c5c796b7d52dfe961a5ed15a03fdb

7 years agoDO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e am: afaa438503
Wonsik Kim [Thu, 16 Feb 2017 01:34:50 +0000 (01:34 +0000)]
DO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e am: afaa438503
am: daaabdcaac  -s ours

Change-Id: I20ff9fb7d3d5f3be5e9c21d0335ed15844a5dd15

7 years agoDO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e
Wonsik Kim [Thu, 16 Feb 2017 01:31:19 +0000 (01:31 +0000)]
DO NOT MERGE codecs: handle onReset() for a few encoders am: dd447c354e
am: afaa438503

Change-Id: Ife5d8803e38a6d62f820929c6eb83b93f8ec64c1

7 years agoDO NOT MERGE codecs: handle onReset() for a few encoders
Wonsik Kim [Thu, 16 Feb 2017 01:28:51 +0000 (01:28 +0000)]
DO NOT MERGE codecs: handle onReset() for a few encoders
am: dd447c354e

Change-Id: I0f2bde22c3e3b19d364ffce46f2e7c67f4016d75

7 years agocodecs: handle onReset() for a few encoders
Wonsik Kim [Thu, 16 Feb 2017 01:28:50 +0000 (01:28 +0000)]
codecs: handle onReset() for a few encoders
am: 5443b57cc5

Change-Id: Ifd851c8840abc615eecf0da1f6b32f30cfb4e0b2

7 years agocodecs: handle onReset() for a few encoders
Wonsik Kim [Fri, 10 Feb 2017 05:29:40 +0000 (14:29 +0900)]
codecs: handle onReset() for a few encoders

Test: Run PoC binaries
Bug: 34749392
Bug: 34705519
Change-Id: I3356eb615b0e79272d71d72578d363671038c6dd

7 years agoDO NOT MERGE codecs: handle onReset() for a few encoders
Wonsik Kim [Fri, 10 Feb 2017 05:29:40 +0000 (14:29 +0900)]
DO NOT MERGE codecs: handle onReset() for a few encoders

Test: Run PoC binaries
Bug: 34749392
Bug: 34705519
Change-Id: I3356eb615b0e79272d71d72578d363671038c6dd

7 years agoDO NOT MERGE AudioFlinger: Check framecount overflow when creating track
Andy Hung [Tue, 14 Feb 2017 02:48:39 +0000 (18:48 -0800)]
DO NOT MERGE AudioFlinger: Check framecount overflow when creating track

Test: Native POC
Bug: 34749571
Change-Id: I7529658e52ac7e64d162eb5338f10fb25eaa8fe7

7 years agoAudioFlinger: Check framecount overflow when creating track
Andy Hung [Tue, 14 Feb 2017 02:48:39 +0000 (18:48 -0800)]
AudioFlinger: Check framecount overflow when creating track

Test: Native POC
Bug: 34749571
Change-Id: I7529658e52ac7e64d162eb5338f10fb25eaa8fe7
(cherry picked from commit 1883f69de5f2c4e71df58d5b71d7c39f9779b50c)

7 years agoEffectBundle: check nb channels to write speaker angles
Jean-Michel Trivi [Tue, 14 Feb 2017 20:51:25 +0000 (20:51 +0000)]
EffectBundle: check nb channels to write speaker angles
am: e5a54485e0

Change-Id: I131f8d196034854f562a175874bce19b29904664

7 years agoEffectBundle: check nb channels to write speaker angles
Jean-Michel Trivi [Tue, 14 Feb 2017 00:31:20 +0000 (16:31 -0800)]
EffectBundle: check nb channels to write speaker angles

When speaker angles are queried, the size of the array for the
  returned data is 3x the number of channels (where really it
  should be max(2, nbChannels)). The code assumed it was at
  least 3x2 (where 2 is the number of virtual speakers this
  effect supports) and would thus crash when called for a mono
  channel mask.

Test: see repro steps in bug
Bug: 32591350
Change-Id: I33d4bff6b2e19a9fc4284a85a446804878d3a410

7 years agoMerge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce am:...
Marco Nelissen [Mon, 13 Feb 2017 21:49:17 +0000 (21:49 +0000)]
Merge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce am: e541fa1764 am: 7f3980c0ca
am: ea2023406b

Change-Id: I68fa183d94f46f7578f8b0718da9a3efd9b4946c

7 years agoMerge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff...
Marco Nelissen [Mon, 13 Feb 2017 21:49:03 +0000 (21:49 +0000)]
Merge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff04d am: 86bd734f58 am: 7902138f2e
am: a23c9a47ab

Change-Id: I4cfef0f49e467337c36b9283d2959ddd68e41bd3

7 years agoMerge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce am:...
Marco Nelissen [Mon, 13 Feb 2017 21:46:48 +0000 (21:46 +0000)]
Merge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce am: e541fa1764
am: 7f3980c0ca

Change-Id: Iaa2a11e1924fdcfe83ca8c8e9a7925850ceb53be

7 years agoMerge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff...
Marco Nelissen [Mon, 13 Feb 2017 21:46:33 +0000 (21:46 +0000)]
Merge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff04d am: 86bd734f58
am: 7902138f2e

Change-Id: I2d9be870193a986d9cd21d7527c4069cd1f184ed

7 years agoMerge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce
Marco Nelissen [Mon, 13 Feb 2017 21:43:48 +0000 (21:43 +0000)]
Merge "Fix overflow check and check read result" into klp-dev am: b6aa3901ce
am: e541fa1764

Change-Id: Ia2962471693b1c4302d4535a0f95dd8d914c3cb8

7 years agoMerge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff04d
Marco Nelissen [Mon, 13 Feb 2017 21:43:31 +0000 (21:43 +0000)]
Merge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff04d
am: 86bd734f58

Change-Id: I3729ea0064642ac10292561d450565ee735af369

7 years agoMerge "Fix overflow check and check read result" into klp-dev
Marco Nelissen [Mon, 13 Feb 2017 21:41:14 +0000 (21:41 +0000)]
Merge "Fix overflow check and check read result" into klp-dev
am: b6aa3901ce

Change-Id: I80ef33d8f0593fa723077e91a5ca406f27b0b746

7 years agoMerge "stagefright: parseApp check data boundary conditions" into klp-dev
Marco Nelissen [Mon, 13 Feb 2017 21:40:59 +0000 (21:40 +0000)]
Merge "stagefright: parseApp check data boundary conditions" into klp-dev
am: 65433ff04d

Change-Id: I6be526b6ed9df22c9699445efaa4f0ed2ae266b4

7 years agoMerge "Fix overflow check and check read result" into klp-dev
Marco Nelissen [Mon, 13 Feb 2017 21:36:48 +0000 (21:36 +0000)]
Merge "Fix overflow check and check read result" into klp-dev

7 years agoMerge "stagefright: parseApp check data boundary conditions" into klp-dev
Marco Nelissen [Mon, 13 Feb 2017 21:35:18 +0000 (21:35 +0000)]
Merge "stagefright: parseApp check data boundary conditions" into klp-dev

7 years agoFix overflow check and check read result
Marco Nelissen [Mon, 6 Feb 2017 22:12:30 +0000 (14:12 -0800)]
Fix overflow check and check read result

Bug: 33861560
Test: build
Change-Id: Ia85519766e19a6e37237166f309750b3e8323c4e

7 years agoMerge "CameraBase: Don't return an sp<> by reference" into klp-dev am: fdf64bab96...
Eino-Ville Talvala [Thu, 2 Feb 2017 23:54:35 +0000 (23:54 +0000)]
Merge "CameraBase: Don't return an sp<> by reference" into klp-dev am: fdf64bab96 am: 4fca12e56f am: f0009384d8
am: 7a14d95270

Change-Id: I42cf5ca9442728273ff2d90095b6d1520c75762a