db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2015-1539
CWE: CWE-189
Vulnerability description: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.

Project: Android

status_t ESDS::parseESDescriptor(size_t offset, size_t size) {
 if (size < 3) {
 return ERROR_MALFORMED;
 }

    offset += 2; // skip ES_ID
    size -= 2;

 unsigned streamDependenceFlag = mData[offset] & 0x80;
 unsigned URL_Flag = mData[offset] & 0x40;
 unsigned OCRstreamFlag = mData[offset] & 0x20;

 ++offset;

     --size;
 
     if (streamDependenceFlag) {
        if (size < 2)
            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;
     }

 if (URL_Flag) {
 if (offset >= size) {

             return ERROR_MALFORMED;
         }
         unsigned URLlength = mData[offset];
        if (URLlength >= size)
            return ERROR_MALFORMED;
         offset += URLlength + 1;
         size -= URLlength + 1;
     }
 
     if (OCRstreamFlag) {
        if (size < 2)
            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;
 
 if ((offset >= size || mData[offset] != kTag_DecoderConfigDescriptor)
 && offset - 2 < size
 && mData[offset - 2] == kTag_DecoderConfigDescriptor) {
            offset -= 2;
            size += 2;

            ALOGW("Found malformed 'esds' atom, ignoring missing OCR_ES_Id.");
 }
 }

 if (offset >= size) {
 return ERROR_MALFORMED;
 }

 uint8_t tag;
 size_t sub_offset, sub_size;
 status_t err = skipDescriptorHeader(
            offset, size, &tag, &sub_offset, &sub_size);

 if (err != OK) {
 return err;
 }

 if (tag != kTag_DecoderConfigDescriptor) {
 return ERROR_MALFORMED;
 }

    err = parseDecoderConfigDescriptor(sub_offset, sub_size);

 return err;
}
Commit message: None
CVE: CVE-2015-1536
CWE: CWE-189
Vulnerability description: Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.

Project: Android

static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
 if (parcel == NULL) {
 SkDebugf("-------- unparcel parcel is NULL\n");
 return NULL;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 const bool        isMutable = p->readInt32() != 0;
 const SkColorType colorType = (SkColorType)p->readInt32();
 const SkAlphaType alphaType = (SkAlphaType)p->readInt32();
 const int         width = p->readInt32();
 const int         height = p->readInt32();
 const int         rowBytes = p->readInt32();
 const int         density = p->readInt32();

 if (kN32_SkColorType != colorType &&
            kRGB_565_SkColorType != colorType &&
            kARGB_4444_SkColorType != colorType &&
            kIndex_8_SkColorType != colorType &&
            kAlpha_8_SkColorType != colorType) {
 SkDebugf("Bitmap_createFromParcel unknown colortype: %d\n", colorType);

         return NULL;
     }
 
    SkAutoTDelete<SkBitmap> bitmap(new SkBitmap);
 
    if (!bitmap->setInfo(SkImageInfo::Make(width, height, colorType, alphaType), rowBytes)) {
        return NULL;
    }
 
     SkColorTable* ctable = NULL;
     if (colorType == kIndex_8_SkColorType) {
         int count = p->readInt32();
        if (count < 0 || count > 256) {
            // The data is corrupt, since SkColorTable enforces a value between 0 and 256,
            // inclusive.
            return NULL;
        }
         if (count > 0) {
             size_t size = count * sizeof(SkPMColor);
             const SkPMColor* src = (const SkPMColor*)p->readInplace(size);
            if (src == NULL) {
                return NULL;
            }
             ctable = new SkColorTable(src, count);
         }
     }
 
    jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap.get(), ctable);
     if (NULL == buffer) {
         SkSafeUnref(ctable);
         return NULL;
     }
 
 SkSafeUnref(ctable);

 size_t size = bitmap->getSize();

    android::Parcel::ReadableBlob blob;

     android::status_t status = p->readBlob(size, &blob);
     if (status) {
         doThrowRE(env, "Could not read bitmap from parcel blob.");
         return NULL;
     }
 
    bitmap->lockPixels();
    memcpy(bitmap->getPixels(), blob.data(), size);
    bitmap->unlockPixels();

 
     blob.release();
 
    return GraphicsJNI::createBitmap(env, bitmap.detach(), buffer,
            getPremulBitmapCreateFlags(isMutable), NULL, NULL, density);
 }
Commit message: None
CVE: CVE-2016-6722
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-31091777.

Project: Android

status_t SampleIterator::seekTo(uint32_t sampleIndex) {
    ALOGV("seekTo(%d)", sampleIndex);

 if (sampleIndex >= mTable->mNumSampleSizes) {
 return ERROR_END_OF_STREAM;
 }

 if (mTable->mSampleToChunkOffset < 0
 || mTable->mChunkOffsetOffset < 0
 || mTable->mSampleSizeOffset < 0
 || mTable->mTimeToSampleCount == 0) {

 return ERROR_MALFORMED;
 }

 if (mInitialized && mCurrentSampleIndex == sampleIndex) {
 return OK;
 }

 if (!mInitialized || sampleIndex < mFirstChunkSampleIndex) {
        reset();
 }

 if (sampleIndex >= mStopChunkSampleIndex) {
 status_t err;
 if ((err = findChunkRange(sampleIndex)) != OK) {
            ALOGE("findChunkRange failed");
 return err;
 }
 }

    CHECK(sampleIndex < mStopChunkSampleIndex);

 if (mSamplesPerChunk == 0) {
        ALOGE("b/22802344");
 return ERROR_MALFORMED;
 }

 uint32_t chunk =
 (sampleIndex - mFirstChunkSampleIndex) / mSamplesPerChunk

         + mFirstChunk;
 
     if (!mInitialized || chunk != mCurrentChunkIndex) {
         status_t err;
         if ((err = getChunkOffset(chunk, &mCurrentChunkOffset)) != OK) {
             ALOGE("getChunkOffset return error");
 return err;
 }

        mCurrentChunkSampleSizes.clear();

 
         uint32_t firstChunkSampleIndex =
             mFirstChunkSampleIndex
                + mSamplesPerChunk * (chunk - mFirstChunk);
 
         for (uint32_t i = 0; i < mSamplesPerChunk; ++i) {
             size_t sampleSize;
             if ((err = getSampleSizeDirect(
                             firstChunkSampleIndex + i, &sampleSize)) != OK) {
                 ALOGE("getSampleSizeDirect return error");
                mCurrentChunkSampleSizes.clear();
                 return err;
             }
 
             mCurrentChunkSampleSizes.push(sampleSize);
         }

        mCurrentChunkIndex = chunk;
     }
 
     uint32_t chunkRelativeSampleIndex =
 (sampleIndex - mFirstChunkSampleIndex) % mSamplesPerChunk;

    mCurrentSampleOffset = mCurrentChunkOffset;
 for (uint32_t i = 0; i < chunkRelativeSampleIndex; ++i) {
        mCurrentSampleOffset += mCurrentChunkSampleSizes[i];
 }

    mCurrentSampleSize = mCurrentChunkSampleSizes[chunkRelativeSampleIndex];
 if (sampleIndex < mTTSSampleIndex) {
        mTimeToSampleIndex = 0;
        mTTSSampleIndex = 0;
        mTTSSampleTime = 0;
        mTTSCount = 0;
        mTTSDuration = 0;
 }

 status_t err;
 if ((err = findSampleTimeAndDuration(
            sampleIndex, &mCurrentSampleTime, &mCurrentSampleDuration)) != OK) {
        ALOGE("findSampleTime return error");
 return err;
 }

    mCurrentSampleIndex = sampleIndex;

    mInitialized = true;

 return OK;
}
Commit message: None
CVE: CVE-2016-6712
CWE: CWE-20
Vulnerability description: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.

Project: Android

int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
 int new_mi_size;

  vp9_set_mb_mi(cm, width, height);
  new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows);
 if (cm->mi_alloc_size < new_mi_size) {
    cm->free_mi(cm);
 if (cm->alloc_mi(cm, new_mi_size))
 goto fail;
 }

 if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
    free_seg_map(cm);
 if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols))
 goto fail;
 }

 if (cm->above_context_alloc_cols < cm->mi_cols) {
    vpx_free(cm->above_context);
    cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc(
 2 * mi_cols_aligned_to_sb(cm->mi_cols) * MAX_MB_PLANE,
 sizeof(*cm->above_context));
 if (!cm->above_context) goto fail;

    vpx_free(cm->above_seg_context);
    cm->above_seg_context = (PARTITION_CONTEXT *)vpx_calloc(
        mi_cols_aligned_to_sb(cm->mi_cols), sizeof(*cm->above_seg_context));
 if (!cm->above_seg_context) goto fail;
    cm->above_context_alloc_cols = cm->mi_cols;
 }


   return 0;
 
  fail:
  vp9_set_mb_mi(cm, 0, 0);
   vp9_free_context_buffers(cm);
   return 1;
 }
Commit message: None
CVE: CVE-2016-6699
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622.

Project: Android

status_t MediaHTTP::connect(
 const char *uri,
 const KeyedVector<String8, String8> *headers,
 off64_t /* offset */) {
 if (mInitCheck != OK) {
 return mInitCheck;
 }

 KeyedVector<String8, String8> extHeaders;
 if (headers != NULL) {
        extHeaders = *headers;
 }

 if (extHeaders.indexOfKey(String8("User-Agent")) < 0) {

         extHeaders.add(String8("User-Agent"), String8(MakeUserAgent().c_str()));
     }
 
    mLastURI = uri;
    // reconnect() calls with uri == old mLastURI.c_str(), which gets zapped
    // as part of the above assignment. Ensure no accidental later use.
    uri = NULL;

    bool success = mHTTPConnection->connect(mLastURI.c_str(), &extHeaders);
 
     mLastHeaders = extHeaders;
 
     mCachedSizeValid = false;
 
     if (success) {
        AString sanitized = uriDebugString(mLastURI);
         mName = String8::format("MediaHTTP(%s)", sanitized.c_str());
     }
 
 return success ? OK : UNKNOWN_ERROR;
}
Commit message: None
CVE: CVE-2016-3924
CWE: CWE-200
Vulnerability description: services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate EFFECT_CMD_SET_PARAM and EFFECT_CMD_SET_PARAM_DEFERRED commands, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 30204301.

Project: Android

 status_t AudioFlinger::EffectModule::command(uint32_t cmdCode,
                                              uint32_t cmdSize,
                                              void *pCmdData,
 uint32_t *replySize,
 void *pReplyData)
{
 Mutex::Autolock _l(mLock);
    ALOGVV("command(), cmdCode: %d, mEffectInterface: %p", cmdCode, mEffectInterface);

 if (mState == DESTROYED || mEffectInterface == NULL) {
 return NO_INIT;
 }
 if (mStatus != NO_ERROR) {
 return mStatus;
 }
 if (cmdCode == EFFECT_CMD_GET_PARAM &&
 (*replySize < sizeof(effect_param_t) ||
 ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t))) {

         android_errorWriteLog(0x534e4554, "29251553");
         return -EINVAL;
     }
    if ((cmdCode == EFFECT_CMD_SET_PARAM
            || cmdCode == EFFECT_CMD_SET_PARAM_DEFERRED) &&  // DEFERRED not generally used
        (sizeof(effect_param_t) > cmdSize
            || ((effect_param_t *)pCmdData)->psize > cmdSize
                                                     - sizeof(effect_param_t)
            || ((effect_param_t *)pCmdData)->vsize > cmdSize
                                                     - sizeof(effect_param_t)
                                                     - ((effect_param_t *)pCmdData)->psize
            || roundUpDelta(((effect_param_t *)pCmdData)->psize, (uint32_t)sizeof(int)) >
                                                     cmdSize
                                                     - sizeof(effect_param_t)
                                                     - ((effect_param_t *)pCmdData)->psize
                                                     - ((effect_param_t *)pCmdData)->vsize)) {
        android_errorWriteLog(0x534e4554, "30204301");
        return -EINVAL;
    }
     status_t status = (*mEffectInterface)->command(mEffectInterface,
                                                    cmdCode,
                                                    cmdSize,
                                                   pCmdData,
                                                   replySize,
                                                   pReplyData);
 if (cmdCode != EFFECT_CMD_GET_PARAM && status == NO_ERROR) {
 uint32_t size = (replySize == NULL) ? 0 : *replySize;
 for (size_t i = 1; i < mHandles.size(); i++) {
 EffectHandle *h = mHandles[i];
 if (h != NULL && !h->destroyed_l()) {
                h->commandExecuted(cmdCode, cmdSize, pCmdData, size, pReplyData);
 }
 }
 }
 return status;
}
Commit message: None
CVE: CVE-2016-3913
CWE: CWE-264
Vulnerability description: media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain static_cast operation, which allows attackers to gain privileges via a crafted application, aka internal bug 30204103.

Project: Android

status_t MediaPlayerService::Client::setNextPlayer(const sp<IMediaPlayer>& player) {

     ALOGV("setNextPlayer");
     Mutex::Autolock l(mLock);
     sp<Client> c = static_cast<Client*>(player.get());
    if (!mService->hasClient(c)) {
      return BAD_VALUE;
    }

     mNextClient = c;
 
     if (c != NULL) {
 if (mAudioOutput != NULL) {
            mAudioOutput->setNextOutput(c->mAudioOutput);
 } else if ((mPlayer != NULL) && !mPlayer->hardwareOutput()) {
            ALOGE("no current audio output");
 }

 if ((mPlayer != NULL) && (mNextClient->getPlayer() != NULL)) {
            mPlayer->setNextPlayer(mNextClient->getPlayer());
 }
 }

 return OK;
}
Commit message: None
CVE: CVE-2016-3900
CWE: CWE-264
Vulnerability description: cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka internal bug 29431260.

Project: Android

static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)

 {
     const char *perm = "add";
 
    if (multiuser_get_app_id(uid) >= AID_APP) {
         return 0; /* Don't allow apps to register services */
     }
 
 return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
}
Commit message: None
CVE: CVE-2016-3890
CWE: CWE-264
Vulnerability description: The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.

Project: Android

void close_all_sockets(atransport* t) {
    asocket* s;

 /* this is a little gross, but since s->close() *will* modify
    ** the list out from under you, your options are limited.
    */
    std::lock_guard<std::recursive_mutex> lock(local_socket_list_lock);

 restart:
     for (s = local_socket_list.next; s != &local_socket_list; s = s->next) {
         if (s->transport == t || (s->peer && s->peer->transport == t)) {
            s->close(s);
             goto restart;
         }
     }
}
Commit message: None
CVE: CVE-2016-3872
CWE: CWE-119
Vulnerability description: Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to gain privileges via a crafted application, aka internal bug 29421675.

Project: Android

bool SoftVPX::outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader) {
 uint32_t width = outputBufferWidth();
 uint32_t height = outputBufferHeight();

     uint64_t nFilledLen = width;
     nFilledLen *= height;
     if (nFilledLen > UINT32_MAX / 3) {
        ALOGE("b/29421675, nFilledLen overflow %llu w %u h %u",
                (unsigned long long)nFilledLen, width, height);
         android_errorWriteLog(0x534e4554, "29421675");
         return false;
     } else if (outHeader->nAllocLen < outHeader->nFilledLen) {
        ALOGE("b/27597103, buffer too small");
        android_errorWriteLog(0x534e4554, "27597103");
 return false;
 }

 return true;
}
Commit message: None
CVE: CVE-2016-3837
CWE: CWE-200
Vulnerability description: service/jni/com_android_server_wifi_WifiNative.cpp in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a crafted application that provides a MAC address with too few characters, aka internal bug 28164077.

Project: Android

 static byte parseHexByte(const char * &str) {
    if (str[0] == '\0') {
        ALOGE("Passed an empty string");
        return 0;
    }
     byte b = parseHexChar(str[0]);
    if (str[1] == '\0' || str[1] == ':') {
        str ++;
     } else {
         b = b << 4 | parseHexChar(str[1]);
        str += 2;
     }

    // Skip trailing delimiter if not at the end of the string.
    if (str[0] != '\0') {
        str++;
    }
    return b;
 }
Commit message: None
CVE: CVE-2016-3819
CWE: CWE-119
Vulnerability description: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562.

Project: Android

u32 h264bsdInitDpb(
 dpbStorage_t *dpb,
  u32 picSizeInMbs,
  u32 dpbSize,
  u32 maxRefFrames,
  u32 maxFrameNum,
  u32 noReordering)
{

/* Variables */

    u32 i;

/* Code */

    ASSERT(picSizeInMbs);
    ASSERT(maxRefFrames <= MAX_NUM_REF_PICS);
    ASSERT(maxRefFrames <= dpbSize);

     ASSERT(maxFrameNum);
     ASSERT(dpbSize);
 
    // see comment in loop below about size calculation
    if (picSizeInMbs > (UINT32_MAX - 32 - 15) / 384) {
        ALOGE("b/28533562");
        android_errorWriteLog(0x534e4554, "28533562");
        return(MEMORY_ALLOCATION_ERROR);
    }

     dpb->maxLongTermFrameIdx = NO_LONG_TERM_FRAME_INDICES;
     dpb->maxRefFrames        = MAX(maxRefFrames, 1);
     if (noReordering)
        dpb->dpbSize         = dpb->maxRefFrames;
 else
        dpb->dpbSize         = dpbSize;
    dpb->maxFrameNum         = maxFrameNum;
    dpb->noReordering        = noReordering;
    dpb->fullness            = 0;
    dpb->numRefFrames        = 0;
    dpb->prevRefFrameNum     = 0;

    ALLOCATE(dpb->buffer, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t);
 if (dpb->buffer == NULL)
 return(MEMORY_ALLOCATION_ERROR);
    H264SwDecMemset(dpb->buffer, 0,
 (MAX_NUM_REF_IDX_L0_ACTIVE + 1)*sizeof(dpbPicture_t));
 for (i = 0; i < dpb->dpbSize + 1; i++)
 {
 /* Allocate needed amount of memory, which is:
         * image size + 32 + 15, where 32 cames from the fact that in ARM OpenMax
         * DL implementation Functions may read beyond the end of an array,
         * by a maximum of 32 bytes. And +15 cames for the need to align memory
         * to 16-byte boundary */
        ALLOCATE(dpb->buffer[i].pAllocatedData, (picSizeInMbs*384 + 32+15), u8);
 if (dpb->buffer[i].pAllocatedData == NULL)
 return(MEMORY_ALLOCATION_ERROR);

        dpb->buffer[i].data = ALIGN(dpb->buffer[i].pAllocatedData, 16);
 }

    ALLOCATE(dpb->list, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t*);
    ALLOCATE(dpb->outBuf, dpb->dpbSize+1, dpbOutPicture_t);

 if (dpb->list == NULL || dpb->outBuf == NULL)
 return(MEMORY_ALLOCATION_ERROR);

    H264SwDecMemset(dpb->list, 0,
 ((MAX_NUM_REF_IDX_L0_ACTIVE + 1) * sizeof(dpbPicture_t*)) );

    dpb->numOut = dpb->outIndex = 0;

 return(HANTRO_OK);

}
Commit message: None
CVE: CVE-2016-3765
CWE: CWE-200
Vulnerability description: decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application, aka internal bug 28168413.

Project: Android

 INLINE void impeg2d_bit_stream_flush(void* pv_ctxt, UWORD32 u4_no_of_bits)
 {
     stream_t *ps_stream = (stream_t *)pv_ctxt;
    if ((ps_stream->u4_offset + 64) < ps_stream->u4_max_offset)
     {
         FLUSH_BITS(ps_stream->u4_offset,ps_stream->u4_buf,ps_stream->u4_buf_nxt,u4_no_of_bits,ps_stream->pu4_buf_aligned)
     }
    else
    {
        UWORD32     u4_temp;

        if (((ps_stream->u4_offset & 0x1f) + u4_no_of_bits) >= 32)
        {
            ps_stream->u4_buf              = ps_stream->u4_buf_nxt;
            ps_stream->u4_buf_nxt          = 0;
        }
        ps_stream->u4_offset += u4_no_of_bits;
    }
     return;
 }
Commit message: None
CVE: CVE-2016-3764
CWE: CWE-20
Vulnerability description: media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.

Project: Android

sp<IMemory> MetadataRetrieverClient::getFrameAtTime(int64_t timeUs, int option)
{
    ALOGV("getFrameAtTime: time(%lld us) option(%d)", timeUs, option);
 Mutex::Autolock lock(mLock);
 Mutex::Autolock glock(sLock);
    mThumbnail.clear();
 if (mRetriever == NULL) {
        ALOGE("retriever is not initialized");
 return NULL;
 }
 VideoFrame *frame = mRetriever->getFrameAtTime(timeUs, option);
 if (frame == NULL) {
        ALOGE("failed to capture a video frame");
 return NULL;
 }
 size_t size = sizeof(VideoFrame) + frame->mSize;
    sp<MemoryHeapBase> heap = new MemoryHeapBase(size, 0, "MetadataRetrieverClient");
 if (heap == NULL) {
        ALOGE("failed to create MemoryDealer");
 delete frame;
 return NULL;
 }
    mThumbnail = new MemoryBase(heap, 0, size);
 if (mThumbnail == NULL) {
        ALOGE("not enough memory for VideoFrame size=%u", size);
 delete frame;
 return NULL;
 }
 VideoFrame *frameCopy = static_cast<VideoFrame *>(mThumbnail->pointer());
    frameCopy->mWidth = frame->mWidth;
    frameCopy->mHeight = frame->mHeight;
    frameCopy->mDisplayWidth = frame->mDisplayWidth;
    frameCopy->mDisplayHeight = frame->mDisplayHeight;
    frameCopy->mSize = frame->mSize;
    frameCopy->mRotationAngle = frame->mRotationAngle;

     ALOGV("rotation: %d", frameCopy->mRotationAngle);
     frameCopy->mData = (uint8_t *)frameCopy + sizeof(VideoFrame);
     memcpy(frameCopy->mData, frame->mData, frame->mSize);
    frameCopy->mData = 0;
     delete frame;  // Fix memory leakage
     return mThumbnail;
 }