db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2016-3758
CWE: CWE-119
Vulnerability description: Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.

Project: Android

char* dexOptGenerateCacheFileName(const char* fileName, const char* subFileName)
{
 char nameBuf[512];
 char absoluteFile[sizeof(nameBuf)];
 const size_t kBufLen = sizeof(nameBuf) - 1;
 const char* dataRoot;
 char* cp;

 /*
     * Get the absolute path of the Jar or DEX file.
     */
    absoluteFile[0] = '\0';
 if (fileName[0] != '/') {
 /*
         * Generate the absolute path.  This doesn't do everything it
         * should, e.g. if filename is "./out/whatever" it doesn't crunch
         * the leading "./" out, but it'll do.
         */
 if (getcwd(absoluteFile, kBufLen) == NULL) {

             ALOGE("Can't get CWD while opening jar file");
             return NULL;
         }
        strncat(absoluteFile, "/", kBufLen - strlen(absoluteFile));
     }
    strncat(absoluteFile, fileName, kBufLen - strlen(absoluteFile));
 
     /*
      * Append the name of the Jar file entry, if any.  This is not currently
     * required, but will be if we start putting more than one DEX file

      * in a Jar.
      */
     if (subFileName != NULL) {
        strncat(absoluteFile, "/", kBufLen - strlen(absoluteFile));
        strncat(absoluteFile, subFileName, kBufLen - strlen(absoluteFile));
     }
 
     /* Turn the path into a flat filename by replacing
     * any slashes after the first one with '@' characters.
     */
    cp = absoluteFile + 1;
 while (*cp != '\0') {
 if (*cp == '/') {
 *cp = '@';
 }
        cp++;
 }

 /* Build the name of the cache directory.
     */
    dataRoot = getenv("ANDROID_DATA");
 if (dataRoot == NULL)
        dataRoot = "/data";
    snprintf(nameBuf, kBufLen, "%s/%s", dataRoot, kCacheDirectoryName);
 if (strcmp(dataRoot, "/data") != 0) {
 int result = dexOptMkdir(nameBuf, 0700);
 if (result != 0 && errno != EEXIST) {
            ALOGE("Failed to create dalvik-cache directory %s: %s", nameBuf, strerror(errno));
 return NULL;
 }
 }
    snprintf(nameBuf, kBufLen, "%s/%s/%s", dataRoot, kCacheDirectoryName, kInstructionSet);
 if (strcmp(dataRoot, "/data") != 0) {
 int result = dexOptMkdir(nameBuf, 0700);
 if (result != 0 && errno != EEXIST) {
            ALOGE("Failed to create dalvik-cache directory %s: %s", nameBuf, strerror(errno));
 return NULL;
 }
 }

 
     /* Tack on the file name for the actual cache file path.
      */
    strncat(nameBuf, absoluteFile, kBufLen - strlen(nameBuf));
 
     ALOGV("Cache file for '%s' '%s' is '%s'", fileName, subFileName, nameBuf);
     return strdup(nameBuf);
}
Commit message: None
CVE: CVE-2016-3757
CWE: CWE-20
Vulnerability description: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.

Project: Android

 static void print_maps(struct pid_info_t* info)
 {
     FILE *maps;

     size_t offset;
     char device[10];
     long int inode;
    char file[1024];
 
     strlcat(info->path, "maps", sizeof(info->path));
 
    maps = fopen(info->path, "r");

     if (!maps)
         goto out;
 
    while (fscanf(maps, "%*x-%*x %*s %zx %5s %ld %1023s\n",
                  &offset, device, &inode, file) == 4) {
         if (inode == 0 || !strcmp(device, "00:00"))
             continue;

        printf("%-9s %5d %10s %4s %9s %18s %9zd %10ld %s\n",
                info->cmdline, info->pid, info->user, "mem",
 "???", device, offset, inode, file);
 }

    fclose(maps);

out:
    info->path[info->parent_length] = '\0';
}
Commit message: None
CVE: CVE-2016-2505
CWE: CWE-119
Vulnerability description: mpeg2ts/ATSParser.cpp in libstagefright in mediaserver in Android 6.x before 2016-07-01 does not validate a certain section length, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28333006.

Project: Android

bool ATSParser::PSISection::isCRCOkay() const {
 if (!isComplete()) {
 return false;
 }
 uint8_t* data = mBuffer->data();

 if ((data[1] & 0x80) == 0) {
 return true;
 }


     unsigned sectionLength = U16_AT(data + 1) & 0xfff;
     ALOGV("sectionLength %u, skip %u", sectionLength, mSkipBytes);
 

    if(sectionLength < mSkipBytes) {
        ALOGE("b/28333006");
        android_errorWriteLog(0x534e4554, "28333006");
        return false;
    }

     sectionLength -= mSkipBytes;
 
 uint32_t crc = 0xffffffff;
 for(unsigned i = 0; i < sectionLength + 4 /* crc */; i++) {
 uint8_t b = data[i];
 int index = ((crc >> 24) ^ (b & 0xff)) & 0xff;
        crc = CRC_TABLE[index] ^ (crc << 8);
 }
    ALOGV("crc: %08x\n", crc);
 return (crc == 0);
}
Commit message: None
CVE: CVE-2016-2499
CWE: CWE-200
Vulnerability description: AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 27855172.

Project: Android

AudioSource::AudioSource(
 audio_source_t inputSource, const String16 &opPackageName,
 uint32_t sampleRate, uint32_t channelCount, uint32_t outSampleRate)

     : mStarted(false),
       mSampleRate(sampleRate),
       mOutSampleRate(outSampleRate > 0 ? outSampleRate : sampleRate),
      mTrackMaxAmplitude(false),
      mStartTimeUs(0),
      mMaxAmplitude(0),
       mPrevSampleTimeUs(0),
       mFirstSampleTimeUs(-1ll),
      mInitialReadTimeUs(0),
       mNumFramesReceived(0),
       mNumClientOwnedBuffers(0) {
     ALOGV("sampleRate: %u, outSampleRate: %u, channelCount: %u",
            sampleRate, outSampleRate, channelCount);
    CHECK(channelCount == 1 || channelCount == 2);
    CHECK(sampleRate > 0);

 size_t minFrameCount;
 status_t status = AudioRecord::getMinFrameCount(&minFrameCount,
                                           sampleRate,
                                           AUDIO_FORMAT_PCM_16_BIT,
                                           audio_channel_in_mask_from_count(channelCount));
 if (status == OK) {
 uint32_t frameCount = kMaxBufferSize / sizeof(int16_t) / channelCount;

 size_t bufCount = 2;
 while ((bufCount * frameCount) < minFrameCount) {
            bufCount++;
 }

        mRecord = new AudioRecord(
                    inputSource, sampleRate, AUDIO_FORMAT_PCM_16_BIT,
                    audio_channel_in_mask_from_count(channelCount),
                    opPackageName,
 (size_t) (bufCount * frameCount),
 AudioRecordCallbackFunction,
 this,
                    frameCount /*notificationFrames*/);
        mInitCheck = mRecord->initCheck();
 if (mInitCheck != OK) {
            mRecord.clear();
 }
 } else {
        mInitCheck = status;
 }
}
Commit message: None
CVE: CVE-2016-2494
CWE: CWE-264
Vulnerability description: Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28085658.

Project: Android

static ssize_t get_node_path_locked(struct node* node, char* buf, size_t bufsize) {
 const char* name;
 size_t namelen;
 if (node->graft_path) {
        name = node->graft_path;
        namelen = node->graft_pathlen;
 } else if (node->actual_name) {
        name = node->actual_name;
        namelen = node->namelen;
 } else {
        name = node->name;
        namelen = node->namelen;
 }

 if (bufsize < namelen + 1) {
 return -1;
 }

 
     ssize_t pathlen = 0;
     if (node->parent && node->graft_path == NULL) {
        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 1);
         if (pathlen < 0) {
             return -1;
         }
        buf[pathlen++] = '/';
 }

    memcpy(buf + pathlen, name, namelen + 1); /* include trailing \0 */
 return pathlen + namelen;
}
Commit message: None
CVE: CVE-2016-2449
CWE: CWE-264
Vulnerability description: services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27568958.

Project: Android

status_t Camera3Device::createDefaultRequest(int templateId,

         CameraMetadata *request) {
     ATRACE_CALL();
     ALOGV("%s: for template %d", __FUNCTION__, templateId);

    if (templateId <= 0 || templateId >= CAMERA3_TEMPLATE_COUNT) {
        android_errorWriteWithInfoLog(CameraService::SN_EVENT_LOG_ID, "26866110",
                IPCThreadState::self()->getCallingUid(), NULL, 0);
        return BAD_VALUE;
    }

     Mutex::Autolock il(mInterfaceLock);
     Mutex::Autolock l(mLock);
 
 switch (mStatus) {
 case STATUS_ERROR:
            CLOGE("Device has encountered a serious error");
 return INVALID_OPERATION;
 case STATUS_UNINITIALIZED:
            CLOGE("Device is not initialized!");
 return INVALID_OPERATION;
 case STATUS_UNCONFIGURED:
 case STATUS_CONFIGURED:
 case STATUS_ACTIVE:
 break;
 default:
            SET_ERR_L("Unexpected status: %d", mStatus);
 return INVALID_OPERATION;
 }

 if (!mRequestTemplateCache[templateId].isEmpty()) {
 *request = mRequestTemplateCache[templateId];
 return OK;
 }

 const camera_metadata_t *rawRequest;
    ATRACE_BEGIN("camera3->construct_default_request_settings");
    rawRequest = mHal3Device->ops->construct_default_request_settings(
        mHal3Device, templateId);
    ATRACE_END();
 if (rawRequest == NULL) {
        ALOGI("%s: template %d is not supported on this camera device",
              __FUNCTION__, templateId);
 return BAD_VALUE;
 }
 *request = rawRequest;
    mRequestTemplateCache[templateId] = rawRequest;

 return OK;
}
Commit message: None
CVE: CVE-2016-2420
CWE: CWE-264
Vulnerability description: rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.

Project: Android

char* engrave_tombstone(pid_t pid, pid_t tid, int signal, int original_si_code,
 uintptr_t abort_msg_address, bool dump_sibling_threads,
 bool* detach_failed, int* total_sleep_time_usec) {

 log_t log;

   log.current_tid = tid;
   log.crashed_tid = tid;
 
   int fd = -1;
  char* path = find_and_open_tombstone(&fd);
 
   if (fd < 0) {
     _LOG(&log, logtype::ERROR, "Skipping tombstone write, nothing to do.\n");
 *detach_failed = false;
 return NULL;
 }

  log.tfd = fd;
 int amfd = activity_manager_connect();
  log.amfd = amfd;
 *detach_failed = dump_crash(&log, pid, tid, signal, original_si_code, abort_msg_address,
                              dump_sibling_threads, total_sleep_time_usec);

  ALOGI("\nTombstone written to: %s\n", path);

  close(amfd);
  close(fd);

 return path;
}
Commit message: None
CVE: CVE-2016-2416
CWE: CWE-264
Vulnerability description: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.

Project: Android

void BufferQueueConsumer::dump(String8& result, const char* prefix) const {
 const IPCThreadState* ipc = IPCThreadState::self();
 const pid_t pid = ipc->getCallingPid();
 const uid_t uid = ipc->getCallingUid();
 if ((uid != AID_SHELL)
 && !PermissionCache::checkPermission(String16(

             "android.permission.DUMP"), pid, uid)) {
         result.appendFormat("Permission Denial: can't dump BufferQueueConsumer "
                 "from pid=%d, uid=%d\n", pid, uid);
        android_errorWriteWithInfoLog(0x534e4554, "27046057", uid, NULL, 0);
     } else {
         mCore->dump(result, prefix);
     }
}
Commit message: None
CVE: CVE-2016-1503
CWE: CWE-119
Vulnerability description: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.

Project: Android

valid_length(uint8_t option, int dl, int *type)
{
 const struct dhcp_opt *opt;
 ssize_t sz;

 if (dl == 0)
 return -1;

 for (opt = dhcp_opts; opt->option; opt++) {
 if (opt->option != option)
 continue;

 
 		if (type)
 			*type = opt->type;
		/* The size of RFC3442 and RFC5969 options is checked at a later
		 * stage in the code */
 		if (opt->type == 0 ||
 		    opt->type & (STRING | RFC3442 | RFC5969))
 			return 0;
		/* The code does not use SINT16 / SINT32 together with ARRAY.
		 * It is however far easier to reason about the code if all
		 * possible array elements are included, and also does not code
		 * any additional CPU resources. sizeof(uintXX_t) ==
		 * sizeof(intXX_t) can be assumed. */
 		sz = 0;
		if (opt->type & (UINT32 | SINT32 | IPV4))
 			sz = sizeof(uint32_t);
		else if (opt->type & (UINT16 | SINT16))
 			sz = sizeof(uint16_t);
		else if (opt->type & UINT8)
 			sz = sizeof(uint8_t);
		if (opt->type & ARRAY) {
			/* The result of modulo zero is undefined. There are no
			 * options defined in this file that do not match one of
			 * the if-clauses above, so the following is not really
			 * necessary. However, to avoid confusion and unexpected
			 * behavior if the defined options are ever extended,
			 * returning false here seems sensible. */
			if (!sz) return -1;
			return (dl % sz == 0) ? 0 : -1;
		}
		return (sz == dl) ? 0 : -1;
 	}
 
 	/* unknown option, so let it pass */
 return 0;
}
Commit message: None
CVE: CVE-2016-0846
CWE: CWE-264
Vulnerability description: libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.

Project: Android

sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const
{
 if (mHeap == 0) {
 Parcel data, reply;
        data.writeInterfaceToken(IMemory::getInterfaceDescriptor());
 if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) {
            sp<IBinder> heap = reply.readStrongBinder();
 ssize_t o = reply.readInt32();
 size_t s = reply.readInt32();

             if (heap != 0) {
                 mHeap = interface_cast<IMemoryHeap>(heap);
                 if (mHeap != 0) {
                    size_t heapSize = mHeap->getSize();
                    if (s <= heapSize
                            && o >= 0
                            && (static_cast<size_t>(o) <= heapSize - s)) {
                        mOffset = o;
                        mSize = s;
                    } else {
                        // Hm.
                        android_errorWriteWithInfoLog(0x534e4554,
                            "26877992", -1, NULL, 0);
                        mOffset = 0;
                        mSize = 0;
                    }
                 }
             }
         }
     }
     if (offset) *offset = mOffset;
     if (size) *size = mSize;
    return (mSize > 0) ? mHeap : 0;
 }
Commit message: None
CVE: CVE-2016-0839
CWE: CWE-119
Vulnerability description: post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.

Project: Android

static int vol_prc_lib_release(effect_handle_t handle)
{

     struct listnode *node, *temp_node_next;
     vol_listener_context_t *context = NULL;
     vol_listener_context_t *recv_contex = (vol_listener_context_t *)handle;
    int status = -EINVAL;
     bool recompute_flag = false;
     int active_stream_count = 0;
    uint32_t session_id;
    uint32_t stream_type;
    effect_uuid_t uuid;

     ALOGV("%s context %p", __func__, handle);

    if (recv_contex == NULL) {
        return status;
    }
     pthread_mutex_lock(&vol_listner_init_lock);
    session_id = recv_contex->session_id;
    stream_type = recv_contex->stream_type;
    uuid = recv_contex->desc->uuid;
 
     list_for_each_safe(node, temp_node_next, &vol_effect_list) {
         context = node_to_item(node, struct vol_listener_context_s, effect_list_node);
        if ((memcmp(&(context->desc->uuid), &uuid, sizeof(effect_uuid_t)) == 0)
            && (context->session_id == session_id)
            && (context->stream_type == stream_type)) {
             ALOGV("--- Found something to remove ---");
            list_remove(node);
             PRINT_STREAM_TYPE(context->stream_type);
             if (context->dev_id && AUDIO_DEVICE_OUT_SPEAKER) {
                 recompute_flag = true;
 }
            free(context);
            status = 0;
 } else {
 ++active_stream_count;
 }
 }

 
     if (status != 0) {
         ALOGE("something wrong ... <<<--- Found NOTHING to remove ... ???? --->>>>>");
        pthread_mutex_unlock(&vol_listner_init_lock);
        return status;
     }
 
 if (active_stream_count == 0) {
        current_gain_dep_cal_level = -1;
        current_vol = 0.0;
 }

 if (recompute_flag) {
        check_and_set_gain_dep_cal();
 }

 if (dumping_enabled) {
        dump_list_l();
 }
    pthread_mutex_unlock(&vol_listner_init_lock);
 return status;
}
Commit message: None
CVE: CVE-2016-0809
CWE: CWE-264
Vulnerability description: Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.

Project: Android

void wifi_cleanup(wifi_handle handle, wifi_cleaned_up_handler handler)
{
    hal_info *info = getHalInfo(handle);
 char buf[64];

    info->cleaned_up_handler = handler;
 if (write(info->cleanup_socks[0], "Exit", 4) < 1) {
        ALOGE("could not write to the cleanup socket");
 } else {
        memset(buf, 0, sizeof(buf));
 int result = read(info->cleanup_socks[0], buf, sizeof(buf));
        ALOGE("%s: Read after POLL returned %d, error no = %d", __FUNCTION__, result, errno);
 if (strncmp(buf, "Done", 4) == 0) {
            ALOGE("Event processing terminated");
 } else {
            ALOGD("Rx'ed %s", buf);
 }
 }
    info->clean_up = true;
    pthread_mutex_lock(&info->cb_lock);

 int bad_commands = 0;

 for (int i = 0; i < info->num_event_cb; i++) {
        cb_info *cbi = &(info->event_cb[i]);
 WifiCommand *cmd = (WifiCommand *)cbi->cb_arg;
        ALOGI("Command left in event_cb %p:%s", cmd, (cmd ? cmd->getType(): ""));
 }

 while (info->num_cmd > bad_commands) {
 int num_cmd = info->num_cmd;
        cmd_info *cmdi = &(info->cmd[bad_commands]);
 WifiCommand *cmd = cmdi->cmd;
 if (cmd != NULL) {
            ALOGI("Cancelling command %p:%s", cmd, cmd->getType());

             pthread_mutex_unlock(&info->cb_lock);
             cmd->cancel();
             pthread_mutex_lock(&info->cb_lock);
             if (num_cmd == info->num_cmd) {
                 ALOGI("Cancelling command %p:%s did not work", cmd, (cmd ? cmd->getType(): ""));
                 bad_commands++;
             }
            /* release reference added when command is saved */
            cmd->releaseRef();
         }
     }
 
 for (int i = 0; i < info->num_event_cb; i++) {
        cb_info *cbi = &(info->event_cb[i]);
 WifiCommand *cmd = (WifiCommand *)cbi->cb_arg;
        ALOGE("Leaked command %p", cmd);
 }
    pthread_mutex_unlock(&info->cb_lock);
    internal_cleaned_up_handler(handle);
}
Commit message: None
CVE: CVE-2016-0808
CWE: CWE-19
Vulnerability description: Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.

Project: Android

static bool getCoverageFormat12(vector<uint32_t>& coverage, const uint8_t* data, size_t size) {
 const size_t kNGroupsOffset = 12;
 const size_t kFirstGroupOffset = 16;

     const size_t kGroupSize = 12;
     const size_t kStartCharCodeOffset = 0;
     const size_t kEndCharCodeOffset = 4;
    const size_t kMaxNGroups = 0xfffffff0 / kGroupSize;  // protection against overflow
    // For all values < kMaxNGroups, kFirstGroupOffset + nGroups * kGroupSize fits in 32 bits.
     if (kFirstGroupOffset > size) {
         return false;
     }
     uint32_t nGroups = readU32(data, kNGroupsOffset);
    if (nGroups >= kMaxNGroups || kFirstGroupOffset + nGroups * kGroupSize > size) {
         return false;
     }
     for (uint32_t i = 0; i < nGroups; i++) {
 uint32_t groupOffset = kFirstGroupOffset + i * kGroupSize;
 uint32_t start = readU32(data, groupOffset + kStartCharCodeOffset);
 uint32_t end = readU32(data, groupOffset + kEndCharCodeOffset);
        addRange(coverage, start, end + 1); // file is inclusive, vector is exclusive
 }
 return true;
}
Commit message: None
CVE: CVE-2016-0807
CWE: CWE-264
Vulnerability description: The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.

Project: Android

static bool get_build_id(
 Backtrace* backtrace, uintptr_t base_addr, uint8_t* e_ident, std::string* build_id) {
 HdrType hdr;

  memcpy(&hdr.e_ident[0], e_ident, EI_NIDENT);

 if (backtrace->Read(base_addr + EI_NIDENT, reinterpret_cast<uint8_t*>(&hdr) + EI_NIDENT,
 sizeof(HdrType) - EI_NIDENT) != sizeof(HdrType) - EI_NIDENT) {
 return false;
 }

 for (size_t i = 0; i < hdr.e_phnum; i++) {
 PhdrType phdr;
 if (backtrace->Read(base_addr + hdr.e_phoff + i * hdr.e_phentsize,
 reinterpret_cast<uint8_t*>(&phdr), sizeof(phdr)) != sizeof(phdr)) {
 return false;
 }
 if (phdr.p_type == PT_NOTE) {
 size_t hdr_size = phdr.p_filesz;
 uintptr_t addr = base_addr + phdr.p_offset;
 while (hdr_size >= sizeof(NhdrType)) {
 NhdrType nhdr;
 if (backtrace->Read(addr, reinterpret_cast<uint8_t*>(&nhdr), sizeof(nhdr)) != sizeof(nhdr)) {
 return false;
 }
        addr += sizeof(nhdr);

         if (nhdr.n_type == NT_GNU_BUILD_ID) {
           addr += NOTE_ALIGN(nhdr.n_namesz);
          uint8_t build_id_data[160];
          if (nhdr.n_descsz > sizeof(build_id_data)) {
            ALOGE("Possible corrupted note, desc size value is too large: %u",
                  nhdr.n_descsz);
             return false;
           }
           if (backtrace->Read(addr, build_id_data, nhdr.n_descsz) != nhdr.n_descsz) {
 return false;
 }

          build_id->clear();
 for (size_t bytes = 0; bytes < nhdr.n_descsz; bytes++) {
 *build_id += android::base::StringPrintf("%02x", build_id_data[bytes]);
 }

 return true;
 } else {
          hdr_size -= sizeof(nhdr);
 size_t skip_bytes = NOTE_ALIGN(nhdr.n_namesz) + NOTE_ALIGN(nhdr.n_descsz);
          addr += skip_bytes;
 if (hdr_size < skip_bytes) {
 break;
 }
          hdr_size -= skip_bytes;
 }
 }
 }
 }
 return false;
}