db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2017-0817
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63522430.

Project: Android

bool SimpleSoftOMXComponent::isSetParameterAllowed(
        OMX_INDEXTYPE index, const OMX_PTR params) const {
 if (mState == OMX_StateLoaded) {
 return true;
 }

    OMX_U32 portIndex;

 switch (index) {
 case OMX_IndexParamPortDefinition:
 {
 const OMX_PARAM_PORTDEFINITIONTYPE *portDefs =
 (const OMX_PARAM_PORTDEFINITIONTYPE *) params;
 if (!isValidOMXParam(portDefs)) {
 return false;
 }
            portIndex = portDefs->nPortIndex;
 break;
 }

 case OMX_IndexParamAudioPcm:
 {
 const OMX_AUDIO_PARAM_PCMMODETYPE *pcmMode =
 (const OMX_AUDIO_PARAM_PCMMODETYPE *) params;
 if (!isValidOMXParam(pcmMode)) {
 return false;
 }
            portIndex = pcmMode->nPortIndex;
 break;
 }

 case OMX_IndexParamAudioAac:
 {
 const OMX_AUDIO_PARAM_AACPROFILETYPE *aacMode =
 (const OMX_AUDIO_PARAM_AACPROFILETYPE *) params;
 if (!isValidOMXParam(aacMode)) {
 return false;
 }
            portIndex = aacMode->nPortIndex;
 break;
 }

 default:
 return false;
 }

    CHECK(portIndex < mPorts.size());

 return !mPorts.itemAt(portIndex).mDef.bEnabled;
}

Project: Android

void SimpleSoftOMXComponent::onChangeState(OMX_STATETYPE state) {
    ALOGV("%p requesting change from %d to %d", this, mState, state);

 if (mState == OMX_StateLoaded
 && mTargetState == OMX_StateIdle
 && state == OMX_StateLoaded) {
        ALOGV("load->idle canceled");
        mState = mTargetState = OMX_StateIdle;
        state = OMX_StateLoaded;
 }

    CHECK_EQ((int)mState, (int)mTargetState);

 switch (mState) {
 case OMX_StateLoaded:
            CHECK_EQ((int)state, (int)OMX_StateIdle);
 break;
 case OMX_StateIdle:
            CHECK(state == OMX_StateLoaded || state == OMX_StateExecuting);
 break;
 case OMX_StateExecuting:
 {
            CHECK_EQ((int)state, (int)OMX_StateIdle);

 for (size_t i = 0; i < mPorts.size(); ++i) {
                onPortFlush(i, false /* sendFlushComplete */);
 }

            mState = OMX_StateIdle;
            notify(OMX_EventCmdComplete, OMX_CommandStateSet, state, NULL);
 break;
 }

 default:
            TRESPASS();
 }

    mTargetState = state;

    checkTransitions();
}
Commit message: None
CVE: CVE-2017-0811
Vulnerability description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37930177.

Project: Android

WORD32 ihevcd_calc_poc(codec_t *ps_codec, nal_header_t *ps_nal, WORD8 i1_log2_max_poc_lsb, WORD32 i2_poc_lsb)
{
    WORD32 i4_abs_poc, i4_poc_msb;
    WORD32 max_poc_lsb;
    WORD8 i1_nal_unit_type = ps_nal->i1_nal_unit_type;
    max_poc_lsb = (1 << i1_log2_max_poc_lsb);

 if((!ps_codec->i4_first_pic_done) && (!ps_codec->i4_pic_present))
        ps_codec->i4_prev_poc_msb = -2 * max_poc_lsb;

 if(NAL_IDR_N_LP == i1_nal_unit_type
 || NAL_IDR_W_LP == i1_nal_unit_type
 || NAL_BLA_N_LP == i1_nal_unit_type
 || NAL_BLA_W_DLP == i1_nal_unit_type
 || NAL_BLA_W_LP == i1_nal_unit_type
 || (NAL_CRA == i1_nal_unit_type && !ps_codec->i4_first_pic_done))
 {
        i4_poc_msb = ps_codec->i4_prev_poc_msb + 2 * max_poc_lsb;
        ps_codec->i4_prev_poc_lsb = 0;
        ps_codec->i4_max_prev_poc_lsb = 0;
 }
 else
 {

 if((i2_poc_lsb < ps_codec->i4_prev_poc_lsb)
 && ((ps_codec->i4_prev_poc_lsb - i2_poc_lsb) >= max_poc_lsb / 2))
 {
            i4_poc_msb = ps_codec->i4_prev_poc_msb + max_poc_lsb;
 }
 else if((i2_poc_lsb > ps_codec->i4_prev_poc_lsb)
 && ((i2_poc_lsb - ps_codec->i4_prev_poc_lsb) > max_poc_lsb / 2))
 {
            i4_poc_msb = ps_codec->i4_prev_poc_msb - max_poc_lsb;
 }
 else
 {
            i4_poc_msb = ps_codec->i4_prev_poc_msb;
 }


 }

    i4_abs_poc = i4_poc_msb + i2_poc_lsb;
    ps_codec->i4_max_prev_poc_lsb = MAX(ps_codec->i4_max_prev_poc_lsb, i2_poc_lsb);

 {
        WORD32 is_reference_nal = ((i1_nal_unit_type <= NAL_RSV_VCL_R15) && (i1_nal_unit_type % 2 != 0)) || ((i1_nal_unit_type >= NAL_BLA_W_LP) && (i1_nal_unit_type <= NAL_RSV_RAP_VCL23));
        WORD32 update_prev_poc = ((is_reference_nal) && ((i1_nal_unit_type < NAL_RADL_N) || (i1_nal_unit_type > NAL_RASL_R)));

 if((0 == ps_nal->i1_nuh_temporal_id) &&
 (update_prev_poc))
 {
            ps_codec->i4_prev_poc_lsb = i2_poc_lsb;
            ps_codec->i4_prev_poc_msb = i4_poc_msb;
 }
 }

 return i4_abs_poc;
}

Project: Android

void ihevcd_copy_sps(codec_t *ps_codec, WORD32 sps_id, WORD32 sps_id_ref)
{
 sps_t *ps_sps, *ps_sps_ref;
    WORD16 *pi2_scaling_mat_backup;
    WORD32 scaling_mat_size;

    SCALING_MAT_SIZE(scaling_mat_size);
    ps_sps_ref = ps_codec->ps_sps_base + sps_id_ref;
    ps_sps = ps_codec->ps_sps_base + sps_id;

 if(ps_sps->i1_sps_valid)
 {
 if((ps_sps->i1_log2_ctb_size != ps_sps_ref->i1_log2_ctb_size) ||
 (ps_sps->i2_pic_wd_in_ctb != ps_sps_ref->i2_pic_wd_in_ctb) ||
 (ps_sps->i2_pic_ht_in_ctb != ps_sps_ref->i2_pic_ht_in_ctb))
 {
            ihevcd_unmark_pps(ps_codec, sps_id);
 }
 }

    pi2_scaling_mat_backup = ps_sps->pi2_scaling_mat;

    memcpy(ps_sps, ps_sps_ref, sizeof(sps_t));
    ps_sps->pi2_scaling_mat = pi2_scaling_mat_backup;
    memcpy(ps_sps->pi2_scaling_mat, ps_sps_ref->pi2_scaling_mat, scaling_mat_size * sizeof(WORD16));
    ps_sps->i1_sps_valid = 1;

    ps_codec->s_parse.ps_sps = ps_sps;
}
Commit message: None
CVE: CVE-2017-0635
CWE: CWE-476
Vulnerability description: A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Low due to details specific to the vulnerability. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35467107.

Project: Android

static bool findParam(uint32_t key, T *param,
 KeyedVector<uint32_t, uint64_t> &params) {
    CHECK(param);
 if (params.indexOfKey(key) < 0) {
 return false;
 }
 *param = (T) params[key];
 return true;
}

Project: Android

status_t HevcParameterSets::parseVps(const uint8_t* data, size_t size) {
 NALBitReader reader(data, size);
    reader.skipBits(4);
    reader.skipBits(1);
    reader.skipBits(1);
    reader.skipBits(6);
    reader.skipBits(1);
    reader.skipBits(16);

 if (reader.atLeastNumBitsLeft(96)) {
        mParams.add(kGeneralProfileSpace, reader.getBits(2));
        mParams.add(kGeneralTierFlag, reader.getBits(1));
        mParams.add(kGeneralProfileIdc, reader.getBits(5));
        mParams.add(kGeneralProfileCompatibilityFlags, reader.getBits(32));
        mParams.add(
                kGeneralConstraintIndicatorFlags,
 ((uint64_t)reader.getBits(16) << 32) | reader.getBits(32));
        mParams.add(kGeneralLevelIdc, reader.getBits(8));
 } else {
        reader.skipBits(96);
 }

 return reader.overRead() ? ERROR_MALFORMED : OK;
}
Commit message: None
CVE: CVE-2017-0591
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34097672.

Project: Android

WORD32 ih264d_create_mv_bank(void *pv_dec,
                             UWORD32 ui_width,
                             UWORD32 ui_height)
{
    UWORD8  i;
    UWORD32 col_flag_buffer_size, mvpred_buffer_size;
    UWORD8 *pu1_mv_buf_mgr_base, *pu1_mv_bank_base;
 col_mv_buf_t *ps_col_mv;
 mv_pred_t *ps_mv;
    UWORD8 *pu1_col_zero_flag_buf;
 dec_struct_t *ps_dec = (dec_struct_t *)pv_dec;
    WORD32 buf_ret;
    UWORD32 u4_num_bufs;
    UWORD8 *pu1_buf;
    WORD32 size;
 void *pv_mem_ctxt = ps_dec->pv_mem_ctxt;

    col_flag_buffer_size = ((ui_width * ui_height) >> 4);
    mvpred_buffer_size = sizeof(mv_pred_t)
 * ((ui_width * (ui_height + PAD_MV_BANK_ROW)) >> 4);

    ih264_buf_mgr_init((buf_mgr_t *)ps_dec->pv_mv_buf_mgr);

    ps_col_mv = ps_dec->ps_col_mv_base;

    u4_num_bufs = ps_dec->ps_cur_sps->u1_num_ref_frames + 1;

    u4_num_bufs = MIN(u4_num_bufs, ps_dec->u1_pic_bufs);
    u4_num_bufs = MAX(u4_num_bufs, 2);
    pu1_buf = ps_dec->pu1_mv_bank_buf_base;
 for(i = 0 ; i < u4_num_bufs ; i++)
 {
        pu1_col_zero_flag_buf = pu1_buf;
        pu1_buf += ALIGN64(col_flag_buffer_size);

        ps_mv = (mv_pred_t *)pu1_buf;
        pu1_buf += ALIGN64(mvpred_buffer_size);

        memset(ps_mv, 0, ((ui_width * OFFSET_MV_BANK_ROW) >> 4) * sizeof(mv_pred_t));
        ps_mv += (ui_width*OFFSET_MV_BANK_ROW) >> 4;

        ps_col_mv->pv_col_zero_flag = (void *)pu1_col_zero_flag_buf;
        ps_col_mv->pv_mv = (void *)ps_mv;
        buf_ret = ih264_buf_mgr_add((buf_mgr_t *)ps_dec->pv_mv_buf_mgr, ps_col_mv, i);
 if(0 != buf_ret)
 {
            ps_dec->i4_error_code = ERROR_BUF_MGR;
 return ERROR_BUF_MGR;
 }
        ps_col_mv++;
 }
 return OK;
}
Commit message: None
CVE: CVE-2018-9507
CWE: CWE-125
Vulnerability description: In bta_av_proc_meta_cmd of bta_av_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111893951

Project: Android

static void bta_av_close_all_rc(tBTA_AV_CB* p_cb) {
 int i;

 for (i = 0; i < BTA_AV_NUM_RCB; i++) {
 if ((p_cb->disabling) || (bta_av_cb.rcb[i].shdl != 0))
      bta_av_del_rc(&bta_av_cb.rcb[i]);
 }
}

Project: Android

void bta_av_rc_remote_cmd(tBTA_AV_CB* p_cb, tBTA_AV_DATA* p_data) {
  tBTA_AV_RCB* p_rcb;
 if (p_cb->features & BTA_AV_FEAT_RCCT) {
 if (p_data->hdr.layer_specific < BTA_AV_NUM_RCB) {
      p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
 if (p_rcb->status & BTA_AV_RC_CONN_MASK) {
        AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
 &p_data->api_remote_cmd.msg);
 }
 }
 }
}

Project: Android

void bta_av_rc_vendor_rsp(tBTA_AV_CB* p_cb, tBTA_AV_DATA* p_data) {
  tBTA_AV_RCB* p_rcb;
 if ((p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
 (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) {
 if (p_data->hdr.layer_specific < BTA_AV_NUM_RCB) {
      p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
      AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label,
 &p_data->api_vendor.msg);
 }
 }
}
Commit message: None
CVE: CVE-2018-9505
CWE: CWE-125
Vulnerability description: In mca_ccb_hdl_req of mca_cact.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-110791536

Project: Android

void mca_ccb_cong(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
  MCA_TRACE_DEBUG("mca_ccb_cong cong=%d/%d", p_ccb->cong, p_data->llcong);
  p_ccb->cong = p_data->llcong;
 if (!p_ccb->cong) {
 /* if there's a held packet, send it now */
 if (p_ccb->p_tx_req && !p_ccb->p_tx_req->hdr.layer_specific) {
      p_data = (tMCA_CCB_EVT*)p_ccb->p_tx_req;
      p_ccb->p_tx_req = NULL;
      mca_ccb_snd_req(p_ccb, p_data);
 }
 }
}

Project: Android

void mca_ccb_do_disconn(tMCA_CCB* p_ccb, UNUSED_ATTR tMCA_CCB_EVT* p_data) {
  mca_dcb_close_by_mdl_id(p_ccb, MCA_ALL_MDL_ID);
  L2CA_DisconnectReq(p_ccb->lcid);
}

Project: Android

void mca_ccb_free_msg(UNUSED_ATTR tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
  osi_free(p_data);
}

Project: Android

void mca_ccb_snd_req(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
  tMCA_CCB_MSG* p_msg = (tMCA_CCB_MSG*)p_data;
 uint8_t *p, *p_start;
 bool is_abort = false;
  tMCA_DCB* p_dcb;

  MCA_TRACE_DEBUG("mca_ccb_snd_req cong=%d req=%d", p_ccb->cong,
                  p_msg->op_code);
 /* check for abort request */
 if ((p_ccb->status == MCA_CCB_STAT_PENDING) &&
 (p_msg->op_code == MCA_OP_MDL_ABORT_REQ)) {
    p_dcb = mca_dcb_by_hdl(p_ccb->p_tx_req->dcb_idx);
 /* the Abort API does not have the associated mdl_id.
     * Get the mdl_id in dcb to compose the request */
    p_msg->mdl_id = p_dcb->mdl_id;
    mca_dcb_event(p_dcb, MCA_DCB_API_CLOSE_EVT, NULL);
    osi_free_and_reset((void**)&p_ccb->p_tx_req);
    p_ccb->status = MCA_CCB_STAT_NORM;
    is_abort = true;
 }

 /* no pending outgoing messages or it's an abort request for a pending data
   * channel */
 if ((!p_ccb->p_tx_req) || is_abort) {
    p_ccb->p_tx_req = p_msg;
 if (!p_ccb->cong) {
      BT_HDR* p_pkt = (BT_HDR*)osi_malloc(MCA_CTRL_MTU + sizeof(BT_HDR));

      p_pkt->offset = L2CAP_MIN_OFFSET;
      p = p_start = (uint8_t*)(p_pkt + 1) + L2CAP_MIN_OFFSET;
 *p++ = p_msg->op_code;
      UINT16_TO_BE_STREAM(p, p_msg->mdl_id);
 if (p_msg->op_code == MCA_OP_MDL_CREATE_REQ) {
 *p++ = p_msg->mdep_id;
 *p++ = p_msg->param;
 }
      p_msg->hdr.layer_specific = true; /* mark this message as sent */
      p_pkt->len = p - p_start;
      L2CA_DataWrite(p_ccb->lcid, p_pkt);
 period_ms_t interval_ms = p_ccb->p_rcb->reg.rsp_tout * 1000;
      alarm_set_on_mloop(p_ccb->mca_ccb_timer, interval_ms,
                         mca_ccb_timer_timeout, p_ccb);
 }
 /* else the L2CAP channel is congested. keep the message to be sent later */
 } else {
    MCA_TRACE_WARNING("dropping api req");
    osi_free(p_data);
 }
}
Commit message: None
CVE: CVE-2018-9503
CWE: CWE-125
Vulnerability description: In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-80432928

Project: Android

void rfc_send_fcon(tRFC_MCB* p_mcb, bool is_command) {
 uint8_t* p_data;
  BT_HDR* p_buf = (BT_HDR*)osi_malloc(RFCOMM_CMD_BUF_SIZE);

  p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_CTRL_FRAME_LEN;
  p_data = (uint8_t*)(p_buf + 1) + p_buf->offset;

 *p_data++ = RFCOMM_EA | RFCOMM_I_CR(is_command) | RFCOMM_MX_FCON;
 *p_data++ = RFCOMM_EA | (RFCOMM_MX_FCON_LEN << 1);

 /* Total length is sizeof FCON data + mx header 2 */
  p_buf->len = RFCOMM_MX_FCON_LEN + 2;

  rfc_send_buf_uih(p_mcb, RFCOMM_MX_DLCI, p_buf);
}

Project: Android

void rfc_send_rpn(tRFC_MCB* p_mcb, uint8_t dlci, bool is_command,
                  tPORT_STATE* p_pars, uint16_t mask) {
 uint8_t* p_data;
  BT_HDR* p_buf = (BT_HDR*)osi_malloc(RFCOMM_CMD_BUF_SIZE);

  p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_CTRL_FRAME_LEN;
  p_data = (uint8_t*)(p_buf + 1) + p_buf->offset;

 *p_data++ = RFCOMM_EA | RFCOMM_I_CR(is_command) | RFCOMM_MX_RPN;

 if (!p_pars) {
 *p_data++ = RFCOMM_EA | (RFCOMM_MX_RPN_REQ_LEN << 1);

 *p_data++ = RFCOMM_EA | RFCOMM_CR_MASK | (dlci << RFCOMM_SHIFT_DLCI);

    p_buf->len = RFCOMM_MX_RPN_REQ_LEN + 2;
 } else {
 *p_data++ = RFCOMM_EA | (RFCOMM_MX_RPN_LEN << 1);

 *p_data++ = RFCOMM_EA | RFCOMM_CR_MASK | (dlci << RFCOMM_SHIFT_DLCI);
 *p_data++ = p_pars->baud_rate;
 *p_data++ = (p_pars->byte_size << RFCOMM_RPN_BITS_SHIFT) |
 (p_pars->stop_bits << RFCOMM_RPN_STOP_BITS_SHIFT) |
 (p_pars->parity << RFCOMM_RPN_PARITY_SHIFT) |
 (p_pars->parity_type << RFCOMM_RPN_PARITY_TYPE_SHIFT);
 *p_data++ = p_pars->fc_type;
 *p_data++ = p_pars->xon_char;
 *p_data++ = p_pars->xoff_char;
 *p_data++ = (mask & 0xFF);
 *p_data++ = (mask >> 8);

 /* Total length is sizeof RPN data + mx header 2 */
    p_buf->len = RFCOMM_MX_RPN_LEN + 2;
 }

  rfc_send_buf_uih(p_mcb, RFCOMM_MX_DLCI, p_buf);
}

Project: Android

void rfc_send_sabme(tRFC_MCB* p_mcb, uint8_t dlci) {
 uint8_t* p_data;
 uint8_t cr = RFCOMM_CR(p_mcb->is_initiator, true);
  BT_HDR* p_buf = (BT_HDR*)osi_malloc(RFCOMM_CMD_BUF_SIZE);

  p_buf->offset = L2CAP_MIN_OFFSET;
  p_data = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET;

 /* SABME frame, command, PF = 1, dlci */
 *p_data++ = RFCOMM_EA | cr | (dlci << RFCOMM_SHIFT_DLCI);
 *p_data++ = RFCOMM_SABME | RFCOMM_PF;
 *p_data++ = RFCOMM_EA | 0;

 *p_data =
      RFCOMM_SABME_FCS((uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET, cr, dlci);

  p_buf->len = 4;

  rfc_check_send_cmd(p_mcb, p_buf);
}
Commit message: None
CVE: CVE-2018-9498
CWE: CWE-787
Vulnerability description: In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78354855

Project: Android

bool SkIcoCodec::onDimensionsSupported(const SkISize& dim) {
 return this->chooseCodec(dim, 0) >= 0;
}

Project: Android

SkISize SkIcoCodec::onGetScaledDimensions(float desiredScale) const {
 int origWidth = this->getInfo().width();
 int origHeight = this->getInfo().height();
 float desiredSize = desiredScale * origWidth * origHeight;
 float minError = ((float) (origWidth * origHeight)) - desiredSize + 1.0f;
 int32_t minIndex = -1;
 for (int32_t i = 0; i < fEmbeddedCodecs->count(); i++) {
 int width = fEmbeddedCodecs->operator[](i)->getInfo().width();
 int height = fEmbeddedCodecs->operator[](i)->getInfo().height();
 float error = SkTAbs(((float) (width * height)) - desiredSize);
 if (error < minError) {
            minError = error;
            minIndex = i;
 }
 }
 SkASSERT(minIndex >= 0);

 return fEmbeddedCodecs->operator[](minIndex)->getInfo().dimensions();
}

Project: Android

SkCodec::SkScanlineOrder SkIcoCodec::onGetScanlineOrder() const {
 if (fCurrScanlineCodec) {
 SkASSERT(!fCurrIncrementalCodec);
 return fCurrScanlineCodec->getScanlineOrder();
 }

 if (fCurrIncrementalCodec) {
 return fCurrIncrementalCodec->getScanlineOrder();
 }

 return INHERITED::onGetScanlineOrder();
}

Project: Android

bool SkIcoCodec::onSkipScanlines(int count) {
 SkASSERT(fCurrScanlineCodec);
 return fCurrScanlineCodec->skipScanlines(count);
}

Project: Android

SkCodec::Result SkIcoCodec::onStartIncrementalDecode(const SkImageInfo& dstInfo,
 void* pixels, size_t rowBytes, const SkCodec::Options& options) {
 int index = 0;
 while (true) {
        index = this->chooseCodec(dstInfo.dimensions(), index);
 if (index < 0) {
 break;
 }

 SkCodec* embeddedCodec = fEmbeddedCodecs->operator[](index).get();
 switch (embeddedCodec->startIncrementalDecode(dstInfo,
                pixels, rowBytes, &options)) {
 case kSuccess:
                fCurrIncrementalCodec = embeddedCodec;
                fCurrScanlineCodec = nullptr;
 return kSuccess;
 case kUnimplemented:
 if (embeddedCodec->startScanlineDecode(dstInfo) == kSuccess) {
 return kUnimplemented;
 }
 break;
 default:
 break;
 }

        index++;
 }

 SkCodecPrintf("Error: No matching candidate image in ico.\n");
 return kInvalidScale;
}
Commit message: None
CVE: CVE-2018-9491
CWE: CWE-190
Vulnerability description: In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111603051

Project: Android

media_status_t AMediaCodecCryptoInfo_getIV(AMediaCodecCryptoInfo* ci, uint8_t *dst) {
 if (!ci) {
 return AMEDIA_ERROR_INVALID_OBJECT;
 }
 if (!dst) {
 return AMEDIA_ERROR_INVALID_PARAMETER;
 }
    memcpy(dst, ci->iv, 16);
 return AMEDIA_OK;
}

Project: Android

media_status_t AMediaCodec_configure(
 AMediaCodec *mData,
 const AMediaFormat* format,
 ANativeWindow* window,
 AMediaCrypto *crypto,
 uint32_t flags) {
    sp<AMessage> nativeFormat;
 AMediaFormat_getFormat(format, &nativeFormat);
    ALOGV("configure with format: %s", nativeFormat->debugString(0).c_str());
    sp<Surface> surface = NULL;
 if (window != NULL) {
        surface = (Surface*) window;
 }

 status_t err = mData->mCodec->configure(nativeFormat, surface,
            crypto ? crypto->mCrypto : NULL, flags);
 if (err != OK) {
        ALOGE("configure: err(%d), failed with format: %s",
              err, nativeFormat->debugString(0).c_str());
 }
 return translate_error(err);
}

Project: Android

media_status_t AMediaCodec_releaseOutputBuffer(AMediaCodec *mData, size_t idx, bool render) {
 if (render) {
 return translate_error(mData->mCodec->renderOutputBufferAndRelease(idx));
 } else {
 return translate_error(mData->mCodec->releaseOutputBuffer(idx));
 }
}

Project: Android

media_status_t AMediaCodec_setOutputSurface(AMediaCodec *mData, ANativeWindow* window) {
    sp<Surface> surface = NULL;
 if (window != NULL) {
        surface = (Surface*) window;
 }
 return translate_error(mData->mCodec->setSurface(surface));
}
Commit message: None
CVE: CVE-2017-13190
CWE: CWE-770
Vulnerability description: A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68299873.

Project: Android

WORD32 ihevcd_set_degrade(iv_obj_t *ps_codec_obj,
 void *pv_api_ip,
 void *pv_api_op)
{
 ihevcd_cxa_ctl_degrade_ip_t *ps_ip;
 ihevcd_cxa_ctl_degrade_op_t *ps_op;
 codec_t *ps_codec = (codec_t *)ps_codec_obj->pv_codec_handle;

    ps_ip = (ihevcd_cxa_ctl_degrade_ip_t *)pv_api_ip;
    ps_op = (ihevcd_cxa_ctl_degrade_op_t *)pv_api_op;

    ps_codec->i4_degrade_type = ps_ip->i4_degrade_type;
    ps_codec->i4_nondegrade_interval = ps_ip->i4_nondegrade_interval;
    ps_codec->i4_degrade_pics = ps_ip->i4_degrade_pics;

    ps_op->u4_error_code = 0;
    ps_codec->i4_degrade_pic_cnt = 0;

 return IV_SUCCESS;
}

Project: Android

WORD32 ihevcd_set_num_cores(iv_obj_t *ps_codec_obj,
 void *pv_api_ip,
 void *pv_api_op)
{
 ihevcd_cxa_ctl_set_num_cores_ip_t *ps_ip;
 ihevcd_cxa_ctl_set_num_cores_op_t *ps_op;
 codec_t *ps_codec = (codec_t *)ps_codec_obj->pv_codec_handle;

    ps_ip = (ihevcd_cxa_ctl_set_num_cores_ip_t *)pv_api_ip;
    ps_op = (ihevcd_cxa_ctl_set_num_cores_op_t *)pv_api_op;

#ifdef MULTICORE
    ps_codec->i4_num_cores = ps_ip->u4_num_cores;
#else
    ps_codec->i4_num_cores = 1;
#endif
    ps_op->u4_error_code = 0;
 return IV_SUCCESS;
}
Commit message: None
CVE: CVE-2017-7376
CWE: CWE-119
Vulnerability description: Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

Project: Android

static int is_hex(char c) {
 if (((c >= '0') && (c <= '9')) ||
 ((c >= 'a') && (c <= 'f')) ||
 ((c >= 'A') && (c <= 'F')))
 return(1);
 return(0);
}

Project: Android

xmlParse3986PathAbsolute(xmlURIPtr uri, const char **str)
{
 const char *cur;
 int ret;

    cur = *str;

 if (*cur != '/')
 return(1);
    cur++;
    ret = xmlParse3986Segment(&cur, 0, 0);
 if (ret == 0) {
 while (*cur == '/') {
	    cur++;
	    ret = xmlParse3986Segment(&cur, 0, 1);
 if (ret != 0) return(ret);
 }
 }
 if (uri != NULL) {
 if (uri->path != NULL) xmlFree(uri->path);
 if (cur != *str) {
 if (uri->cleanup & 2)
                uri->path = STRNDUP(*str, cur - *str);
 else
                uri->path = xmlURIUnescapeString(*str, cur - *str, NULL);
 } else {
            uri->path = NULL;
 }
 }
 *str = cur;
 return (0);
}

Project: Android

xmlParse3986PathRootless(xmlURIPtr uri, const char **str)
{
 const char *cur;
 int ret;

    cur = *str;

    ret = xmlParse3986Segment(&cur, 0, 0);
 if (ret != 0) return(ret);
 while (*cur == '/') {
        cur++;
	ret = xmlParse3986Segment(&cur, 0, 1);
 if (ret != 0) return(ret);
 }
 if (uri != NULL) {
 if (uri->path != NULL) xmlFree(uri->path);
 if (cur != *str) {
 if (uri->cleanup & 2)
                uri->path = STRNDUP(*str, cur - *str);
 else
                uri->path = xmlURIUnescapeString(*str, cur - *str, NULL);
 } else {
            uri->path = NULL;
 }
 }
 *str = cur;
 return (0);
}