db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2016-0839
CWE: CWE-119
Vulnerability description: post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.

Project: Android

static int vol_prc_lib_release(effect_handle_t handle)
{

     struct listnode *node, *temp_node_next;
     vol_listener_context_t *context = NULL;
     vol_listener_context_t *recv_contex = (vol_listener_context_t *)handle;
    int status = -1;
     bool recompute_flag = false;
     int active_stream_count = 0;
     ALOGV("%s context %p", __func__, handle);
     pthread_mutex_lock(&vol_listner_init_lock);
 
     list_for_each_safe(node, temp_node_next, &vol_effect_list) {
         context = node_to_item(node, struct vol_listener_context_s, effect_list_node);
        if ((memcmp(&(context->desc->uuid), &(recv_contex->desc->uuid), sizeof(effect_uuid_t)) == 0)
            && (context->session_id == recv_contex->session_id)
            && (context->stream_type == recv_contex->stream_type)) {
             ALOGV("--- Found something to remove ---");
            list_remove(&context->effect_list_node);
             PRINT_STREAM_TYPE(context->stream_type);
             if (context->dev_id && AUDIO_DEVICE_OUT_SPEAKER) {
                 recompute_flag = true;
 }
            free(context);
            status = 0;
 } else {
 ++active_stream_count;
 }
 }

 
     if (status != 0) {
         ALOGE("something wrong ... <<<--- Found NOTHING to remove ... ???? --->>>>>");
     }
 
 if (active_stream_count == 0) {
        current_gain_dep_cal_level = -1;
        current_vol = 0.0;
 }

 if (recompute_flag) {
        check_and_set_gain_dep_cal();
 }

 if (dumping_enabled) {
        dump_list_l();
 }
    pthread_mutex_unlock(&vol_listner_init_lock);
 return status;
}
Commit message: None
CVE: CVE-2016-0809
CWE: CWE-264
Vulnerability description: Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.

Project: Android

void wifi_cleanup(wifi_handle handle, wifi_cleaned_up_handler handler)
{
    hal_info *info = getHalInfo(handle);
 char buf[64];

    info->cleaned_up_handler = handler;
 if (write(info->cleanup_socks[0], "Exit", 4) < 1) {
        ALOGE("could not write to the cleanup socket");
 } else {
        memset(buf, 0, sizeof(buf));
 int result = read(info->cleanup_socks[0], buf, sizeof(buf));
        ALOGE("%s: Read after POLL returned %d, error no = %d", __FUNCTION__, result, errno);
 if (strncmp(buf, "Done", 4) == 0) {
            ALOGE("Event processing terminated");
 } else {
            ALOGD("Rx'ed %s", buf);
 }
 }
    info->clean_up = true;
    pthread_mutex_lock(&info->cb_lock);

 int bad_commands = 0;

 for (int i = 0; i < info->num_event_cb; i++) {
        cb_info *cbi = &(info->event_cb[i]);
 WifiCommand *cmd = (WifiCommand *)cbi->cb_arg;
        ALOGI("Command left in event_cb %p:%s", cmd, (cmd ? cmd->getType(): ""));
 }

 while (info->num_cmd > bad_commands) {
 int num_cmd = info->num_cmd;
        cmd_info *cmdi = &(info->cmd[bad_commands]);
 WifiCommand *cmd = cmdi->cmd;
 if (cmd != NULL) {
            ALOGI("Cancelling command %p:%s", cmd, cmd->getType());

             pthread_mutex_unlock(&info->cb_lock);
             cmd->cancel();
             pthread_mutex_lock(&info->cb_lock);
            /* release reference added when command is saved */
            cmd->releaseRef();
             if (num_cmd == info->num_cmd) {
                 ALOGI("Cancelling command %p:%s did not work", cmd, (cmd ? cmd->getType(): ""));
                 bad_commands++;
             }
         }
     }
 
 for (int i = 0; i < info->num_event_cb; i++) {
        cb_info *cbi = &(info->event_cb[i]);
 WifiCommand *cmd = (WifiCommand *)cbi->cb_arg;
        ALOGE("Leaked command %p", cmd);
 }
    pthread_mutex_unlock(&info->cb_lock);
    internal_cleaned_up_handler(handle);
}
Commit message: None
CVE: CVE-2016-0808
CWE: CWE-19
Vulnerability description: Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.

Project: Android

static bool getCoverageFormat12(vector<uint32_t>& coverage, const uint8_t* data, size_t size) {
 const size_t kNGroupsOffset = 12;
 const size_t kFirstGroupOffset = 16;

     const size_t kGroupSize = 12;
     const size_t kStartCharCodeOffset = 0;
     const size_t kEndCharCodeOffset = 4;
     if (kFirstGroupOffset > size) {
         return false;
     }
     uint32_t nGroups = readU32(data, kNGroupsOffset);
    if (kFirstGroupOffset + nGroups * kGroupSize > size) {
         return false;
     }
     for (uint32_t i = 0; i < nGroups; i++) {
 uint32_t groupOffset = kFirstGroupOffset + i * kGroupSize;
 uint32_t start = readU32(data, groupOffset + kStartCharCodeOffset);
 uint32_t end = readU32(data, groupOffset + kEndCharCodeOffset);
        addRange(coverage, start, end + 1); // file is inclusive, vector is exclusive
 }
 return true;
}
Commit message: None
CVE: CVE-2016-0807
CWE: CWE-264
Vulnerability description: The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.

Project: Android

static bool get_build_id(
 Backtrace* backtrace, uintptr_t base_addr, uint8_t* e_ident, std::string* build_id) {
 HdrType hdr;

  memcpy(&hdr.e_ident[0], e_ident, EI_NIDENT);

 if (backtrace->Read(base_addr + EI_NIDENT, reinterpret_cast<uint8_t*>(&hdr) + EI_NIDENT,
 sizeof(HdrType) - EI_NIDENT) != sizeof(HdrType) - EI_NIDENT) {
 return false;
 }

 for (size_t i = 0; i < hdr.e_phnum; i++) {
 PhdrType phdr;
 if (backtrace->Read(base_addr + hdr.e_phoff + i * hdr.e_phentsize,
 reinterpret_cast<uint8_t*>(&phdr), sizeof(phdr)) != sizeof(phdr)) {
 return false;
 }
 if (phdr.p_type == PT_NOTE) {
 size_t hdr_size = phdr.p_filesz;
 uintptr_t addr = base_addr + phdr.p_offset;
 while (hdr_size >= sizeof(NhdrType)) {
 NhdrType nhdr;
 if (backtrace->Read(addr, reinterpret_cast<uint8_t*>(&nhdr), sizeof(nhdr)) != sizeof(nhdr)) {
 return false;
 }
        addr += sizeof(nhdr);

         if (nhdr.n_type == NT_GNU_BUILD_ID) {
           addr += NOTE_ALIGN(nhdr.n_namesz);
          uint8_t build_id_data[128];
          if (nhdr.n_namesz > sizeof(build_id_data)) {
            ALOGE("Possible corrupted note, name size value is too large: %u",
                  nhdr.n_namesz);
             return false;
           }
           if (backtrace->Read(addr, build_id_data, nhdr.n_descsz) != nhdr.n_descsz) {
 return false;
 }

          build_id->clear();
 for (size_t bytes = 0; bytes < nhdr.n_descsz; bytes++) {
 *build_id += android::base::StringPrintf("%02x", build_id_data[bytes]);
 }

 return true;
 } else {
          hdr_size -= sizeof(nhdr);
 size_t skip_bytes = NOTE_ALIGN(nhdr.n_namesz) + NOTE_ALIGN(nhdr.n_descsz);
          addr += skip_bytes;
 if (hdr_size < skip_bytes) {
 break;
 }
          hdr_size -= skip_bytes;
 }
 }
 }
 }
 return false;
}
Commit message: None
CVE: CVE-2016-0804
CWE: CWE-119
Vulnerability description: The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.

Project: Android

void NuPlayer::GenericSource::notifyPreparedAndCleanup(status_t err) {
 if (err != OK) {
        mMetaDataSize = -1ll;
        mContentType = "";
        mSniffedMIME = "";
 {
            sp<DataSource> dataSource = mDataSource;
            sp<NuCachedSource2> cachedSource = mCachedSource;
            sp<DataSource> httpSource = mHttpSource;

             {
                 Mutex::Autolock _l(mDisconnectLock);
                 mDataSource.clear();
                 mCachedSource.clear();
                 mHttpSource.clear();
             }
 }

        cancelPollBuffering();
 }
    notifyPrepared(err);
}
Commit message: None
CVE: CVE-2015-6640
CWE: CWE-264
Vulnerability description: The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.

Project: Android

static int prctl_set_vma_anon_name(unsigned long start, unsigned long end,
 unsigned long arg)
{
 unsigned long tmp;
 struct vm_area_struct * vma, *prev;
 int unmapped_error = 0;
 int error = -EINVAL;

 /*
	 * If the interval [start,end) covers some unmapped address
	 * ranges, just ignore them, but return -ENOMEM at the end.
	 * - this matches the handling in madvise.
	 */
	vma = find_vma_prev(current->mm, start, &prev);
 if (vma && start > vma->vm_start)
		prev = vma;

 for (;;) {
 /* Still start < end. */
		error = -ENOMEM;
 if (!vma)
 return error;

 /* Here start < (end|vma->vm_end). */
 if (start < vma->vm_start) {
			unmapped_error = -ENOMEM;
			start = vma->vm_start;
 if (start >= end)
 return error;
 }

 /* Here vma->vm_start <= start < (end|vma->vm_end) */
		tmp = vma->vm_end;
 if (end < tmp)

 			tmp = end;
 
 		/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */
		error = prctl_update_vma_anon_name(vma, &prev, start, end,
 				(const char __user *)arg);
 		if (error)
 			return error;
		start = tmp;
 if (prev && start < prev->vm_end)
			start = prev->vm_end;
		error = unmapped_error;
 if (start >= end)
 return error;
 if (prev)
			vma = prev->vm_next;
 else /* madvise_remove dropped mmap_sem */
			vma = find_vma(current->mm, start);
 }
}
Commit message: None
CVE: CVE-2017-0818
CWE: CWE-772
Vulnerability description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671.

Project: Android

status_t MyOpusExtractor::readNextPacket(MediaBuffer **out) {
 if (mOffset <= mFirstDataOffset && mStartGranulePosition < 0) {
 MediaBuffer *mBuf;
 uint32_t numSamples = 0;
 uint64_t curGranulePosition = 0;
 while (true) {
 status_t err = _readNextPacket(&mBuf, /* calcVorbisTimestamp = */false);
 if (err != OK && err != ERROR_END_OF_STREAM) {
 return err;

             }
             if (err == ERROR_END_OF_STREAM || mCurrentPage.mPageNo > 2) {
                 break;
             }
             curGranulePosition = mCurrentPage.mGranulePosition;
            numSamples += getNumSamplesInPacket(mBuf);
            mBuf->release();
            mBuf = NULL;
 }

 if (curGranulePosition > numSamples) {
            mStartGranulePosition = curGranulePosition - numSamples;
 } else {
            mStartGranulePosition = 0;
 }
        seekToOffset(0);
 }

 status_t err = _readNextPacket(out, /* calcVorbisTimestamp = */false);
 if (err != OK) {
 return err;
 }

 int32_t currentPageSamples;
 if ((*out)->meta_data()->findInt32(kKeyValidSamples, &currentPageSamples)) {
 if (mOffset == mFirstDataOffset) {
            currentPageSamples -= mStartGranulePosition;
 (*out)->meta_data()->setInt32(kKeyValidSamples, currentPageSamples);
 }
        mCurGranulePosition = mCurrentPage.mGranulePosition - currentPageSamples;
 }

 int64_t timeUs = getTimeUsOfGranule(mCurGranulePosition);
 (*out)->meta_data()->setInt64(kKeyTime, timeUs);

 uint32_t frames = getNumSamplesInPacket(*out);
    mCurGranulePosition += frames;
 return OK;
}
Commit message: None
CVE: CVE-2017-0813
CWE: CWE-772
Vulnerability description: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046.

Project: Android

status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) {
 if (mSyncSampleOffset >= 0 || data_size < 8) {
 return ERROR_MALFORMED;
 }

 uint8_t header[8];
 if (mDataSource->readAt(
                data_offset, header, sizeof(header)) < (ssize_t)sizeof(header)) {
 return ERROR_IO;
 }

 if (U32_AT(header) != 0) {
 return ERROR_MALFORMED;
 }

 uint32_t numSyncSamples = U32_AT(&header[4]);

 if (numSyncSamples < 2) {
        ALOGV("Table of sync samples is empty or has only a single entry!");
 }

 uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);
 if (allocSize > kMaxTotalSize) {
        ALOGE("Sync sample table size too large.");
 return ERROR_OUT_OF_RANGE;
 }

    mTotalSize += allocSize;
 if (mTotalSize > kMaxTotalSize) {
        ALOGE("Sync sample table size would make sample table too large.\n"
 "    Requested sync sample table size = %llu\n"
 "    Eventual sample table size >= %llu\n"
 "    Allowed sample table size = %llu\n",
 (unsigned long long)allocSize,
 (unsigned long long)mTotalSize,
 (unsigned long long)kMaxTotalSize);
 return ERROR_OUT_OF_RANGE;
 }

    mSyncSamples = new (std::nothrow) uint32_t[numSyncSamples];
 if (!mSyncSamples) {
        ALOGE("Cannot allocate sync sample table with %llu entries.",
 (unsigned long long)numSyncSamples);
 return ERROR_OUT_OF_RANGE;
 }

 
     if (mDataSource->readAt(data_offset + 8, mSyncSamples,
             (size_t)allocSize) != (ssize_t)allocSize) {
        delete mSyncSamples;
         mSyncSamples = NULL;
         return ERROR_IO;
     }

 for (size_t i = 0; i < numSyncSamples; ++i) {
 if (mSyncSamples[i] == 0) {
            ALOGE("b/32423862, unexpected zero value in stss");
 continue;
 }
        mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
 }

    mSyncSampleOffset = data_offset;
    mNumSyncSamples = numSyncSamples;

 return OK;
}
Commit message: None
CVE: CVE-2017-0635
CWE: CWE-476
Vulnerability description: A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Low due to details specific to the vulnerability. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35467107.

Project: Android

 status_t HevcParameterSets::addNalUnit(const uint8_t* data, size_t size) {
     uint8_t nalUnitType = (data[0] >> 1) & 0x3f;
     status_t err = OK;
     switch (nalUnitType) {
         case 32:  // VPS
             err = parseVps(data + 2, size - 2);
             break;
         case 33:  // SPS
             err = parseSps(data + 2, size - 2);
             break;
         case 34:  // PPS
             err = parsePps(data + 2, size - 2);
             break;
         case 39:  // Prefix SEI
 case 40: // Suffix SEI
 break;
 default:
            ALOGE("Unrecognized NAL unit type.");
 return ERROR_MALFORMED;
 }

 if (err != OK) {
 return err;
 }

    sp<ABuffer> buffer = ABuffer::CreateAsCopy(data, size);
    buffer->setInt32Data(nalUnitType);
    mNalUnits.push(buffer);
 return OK;
}
Commit message: None
CVE: CVE-2017-0588
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607.

Project: Android

bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
 size_t oldSize = mSize;

 size_t offset = 0;
 while (mSize >= 10 && offset <= mSize - 10) {
 if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
 break;
 }

 size_t dataSize;
 if (iTunesHack) {
            dataSize = U32_AT(&mData[offset + 4]);
 } else if (!ParseSyncsafeInteger(&mData[offset + 4], &dataSize)) {
 return false;
 }

 if (dataSize > mSize - 10 - offset) {
 return false;
 }

 uint16_t flags = U16_AT(&mData[offset + 8]);
 uint16_t prevFlags = flags;

 if (flags & 1) {

 if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
 return false;
 }
            memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
            mSize -= 4;
            dataSize -= 4;


             flags &= ~1;
         }
 
        if (flags & 2) {
 
 size_t readOffset = offset + 11;
 size_t writeOffset = offset + 11;
 for (size_t i = 0; i + 1 < dataSize; ++i) {
 if (mData[readOffset - 1] == 0xff
 && mData[readOffset] == 0x00) {
 ++readOffset;
 --mSize;
 --dataSize;
 }

                 mData[writeOffset++] = mData[readOffset++];
             }
            memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);
 
            flags &= ~2;
         }
         if (flags != prevFlags || iTunesHack) {
             WriteSyncsafeInteger(&mData[offset + 4], dataSize);
             mData[offset + 8] = flags >> 8;
            mData[offset + 9] = flags & 0xff;
 }

        offset += 10 + dataSize;
 }

    memset(&mData[mSize], 0, oldSize - mSize);

 return true;
}
Commit message: None
CVE: CVE-2017-0541
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018.

Project: Android

static EAS_RESULT PushcdlStack (EAS_U32 *pStack, EAS_INT *pStackPtr, EAS_U32 value)

 {
 
     /* stack overflow, return an error */
    if (*pStackPtr >= CDL_STACK_SIZE)
         return EAS_ERROR_FILE_FORMAT;
 
     /* push the value onto the stack */
     *pStackPtr = *pStackPtr + 1;
    pStack[*pStackPtr] = value;
 return EAS_SUCCESS;
}
Commit message: None
CVE: CVE-2018-9510
CWE: CWE-200
Vulnerability description: In smp_proc_enc_info of smp_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111937065

Project: Android

void smp_proc_enc_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {

   uint8_t* p = p_data->p_data;
 
   SMP_TRACE_DEBUG("%s", __func__);
   STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);
 
   smp_key_distribution(p_cb, NULL);
}
Commit message: None
CVE: CVE-2018-9509
CWE: CWE-200
Vulnerability description: In smp_proc_master_id of smp_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111937027

Project: Android

void smp_proc_master_id(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
 uint8_t* p = p_data->p_data;

   tBTM_LE_PENC_KEYS le_key;
 
   SMP_TRACE_DEBUG("%s", __func__);
   smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_ENC, true);
 
   STREAM_TO_UINT16(le_key.ediv, p);
  STREAM_TO_ARRAY(le_key.rand, p, BT_OCTET8_LEN);

 /* store the encryption keys from peer device */
  memcpy(le_key.ltk, p_cb->ltk, BT_OCTET16_LEN);
  le_key.sec_level = p_cb->sec_level;
  le_key.key_size = p_cb->loc_enc_size;

 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) &&
 (p_cb->loc_auth_req & SMP_AUTH_BOND))
    btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_PENC,
 (tBTM_LE_KEY_VALUE*)&le_key, true);

  smp_key_distribution(p_cb, NULL);
}
Commit message: None
CVE: CVE-2018-9508
CWE: CWE-125
Vulnerability description: In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-111936834

Project: Android

void smp_process_keypress_notification(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
 uint8_t* p = (uint8_t*)p_data;

   uint8_t reason = SMP_INVALID_PARAMETERS;
 
   SMP_TRACE_DEBUG("%s", __func__);
  p_cb->status = *(uint8_t*)p_data;
 
   if (smp_command_has_invalid_parameters(p_cb)) {
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
     return;
   }
 
   if (p != NULL) {
     STREAM_TO_UINT8(p_cb->peer_keypress_notification, p);
   } else {
    p_cb->peer_keypress_notification = BTM_SP_KEY_OUT_OF_RANGE;
 }
  p_cb->cb_evt = SMP_PEER_KEYPR_NOT_EVT;
}
Commit message: None
CVE: CVE-2018-9504
CWE: CWE-787
Vulnerability description: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-110216176

Project: Android

static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
 unsigned int cpy_len, rem_len;
 uint32_t list_len;
 uint8_t* p;
 uint8_t type;

#if (SDP_DEBUG_RAW == TRUE)
 uint8_t num_array[SDP_MAX_LIST_BYTE_COUNT];
 uint32_t i;

 for (i = 0; i < p_ccb->list_len; i++) {
    snprintf((char*)&num_array[i * 2], sizeof(num_array) - i * 2, "%02X",
 (uint8_t)(p_ccb->rsp_list[i]));
 }
  SDP_TRACE_WARNING("result :%s", num_array);
#endif

 if (p_ccb->p_db->raw_data) {
    cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used;
    list_len = p_ccb->list_len;

     p = &p_ccb->rsp_list[0];
 
     if (offset) {
       type = *p++;
       p = sdpu_get_len_from_type(p, type, &list_len);
     }
     if (list_len < cpy_len) {
       cpy_len = list_len;
 }
    rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);
 if (cpy_len > rem_len) {
      SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
      cpy_len = rem_len;
 }
    SDP_TRACE_WARNING(
 "%s: list_len:%d cpy_len:%d p:%p p_ccb:%p p_db:%p raw_size:%d "
 "raw_used:%d raw_data:%p",
        __func__, list_len, cpy_len, p, p_ccb, p_ccb->p_db,
        p_ccb->p_db->raw_size, p_ccb->p_db->raw_used, p_ccb->p_db->raw_data);
    memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
    p_ccb->p_db->raw_used += cpy_len;
 }
}
Commit message: None
CVE: CVE-2018-9499
CWE: CWE-200
Vulnerability description: In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-79218474

Project: Android

 void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
    vector.insertAt((size_t)0, size);
    data.read(vector.editArray(), size);
 }