db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2016-3764
CWE: CWE-20
Vulnerability description: media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.

Project: Android

sp<IMemory> MetadataRetrieverClient::getFrameAtTime(int64_t timeUs, int option)
{
    ALOGV("getFrameAtTime: time(%lld us) option(%d)", timeUs, option);
 Mutex::Autolock lock(mLock);
 Mutex::Autolock glock(sLock);
    mThumbnail.clear();
 if (mRetriever == NULL) {
        ALOGE("retriever is not initialized");
 return NULL;
 }
 VideoFrame *frame = mRetriever->getFrameAtTime(timeUs, option);
 if (frame == NULL) {
        ALOGE("failed to capture a video frame");
 return NULL;
 }
 size_t size = sizeof(VideoFrame) + frame->mSize;
    sp<MemoryHeapBase> heap = new MemoryHeapBase(size, 0, "MetadataRetrieverClient");
 if (heap == NULL) {
        ALOGE("failed to create MemoryDealer");
 delete frame;
 return NULL;
 }
    mThumbnail = new MemoryBase(heap, 0, size);
 if (mThumbnail == NULL) {
        ALOGE("not enough memory for VideoFrame size=%u", size);
 delete frame;
 return NULL;
 }
 VideoFrame *frameCopy = static_cast<VideoFrame *>(mThumbnail->pointer());
    frameCopy->mWidth = frame->mWidth;
    frameCopy->mHeight = frame->mHeight;
    frameCopy->mDisplayWidth = frame->mDisplayWidth;
    frameCopy->mDisplayHeight = frame->mDisplayHeight;
    frameCopy->mSize = frame->mSize;
    frameCopy->mRotationAngle = frame->mRotationAngle;

     ALOGV("rotation: %d", frameCopy->mRotationAngle);
     frameCopy->mData = (uint8_t *)frameCopy + sizeof(VideoFrame);
     memcpy(frameCopy->mData, frame->mData, frame->mSize);
     delete frame;  // Fix memory leakage
     return mThumbnail;
 }
Commit message: None
CVE: CVE-2016-3758
CWE: CWE-119
Vulnerability description: Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.

Project: Android

char* dexOptGenerateCacheFileName(const char* fileName, const char* subFileName)
{
 char nameBuf[512];
 char absoluteFile[sizeof(nameBuf)];
 const size_t kBufLen = sizeof(nameBuf) - 1;
 const char* dataRoot;
 char* cp;

 /*
     * Get the absolute path of the Jar or DEX file.
     */
    absoluteFile[0] = '\0';
 if (fileName[0] != '/') {
 /*
         * Generate the absolute path.  This doesn't do everything it
         * should, e.g. if filename is "./out/whatever" it doesn't crunch
         * the leading "./" out, but it'll do.
         */
 if (getcwd(absoluteFile, kBufLen) == NULL) {

             ALOGE("Can't get CWD while opening jar file");
             return NULL;
         }
        strncat(absoluteFile, "/", kBufLen);
     }
    strncat(absoluteFile, fileName, kBufLen);
 
     /*
      * Append the name of the Jar file entry, if any.  This is not currently
     * required, but will be if we start putting more than one DEX file

      * in a Jar.
      */
     if (subFileName != NULL) {
        strncat(absoluteFile, "/", kBufLen);
        strncat(absoluteFile, subFileName, kBufLen);
     }
 
     /* Turn the path into a flat filename by replacing
     * any slashes after the first one with '@' characters.
     */
    cp = absoluteFile + 1;
 while (*cp != '\0') {
 if (*cp == '/') {
 *cp = '@';
 }
        cp++;
 }

 /* Build the name of the cache directory.
     */
    dataRoot = getenv("ANDROID_DATA");
 if (dataRoot == NULL)
        dataRoot = "/data";
    snprintf(nameBuf, kBufLen, "%s/%s", dataRoot, kCacheDirectoryName);
 if (strcmp(dataRoot, "/data") != 0) {
 int result = dexOptMkdir(nameBuf, 0700);
 if (result != 0 && errno != EEXIST) {
            ALOGE("Failed to create dalvik-cache directory %s: %s", nameBuf, strerror(errno));
 return NULL;
 }
 }
    snprintf(nameBuf, kBufLen, "%s/%s/%s", dataRoot, kCacheDirectoryName, kInstructionSet);
 if (strcmp(dataRoot, "/data") != 0) {
 int result = dexOptMkdir(nameBuf, 0700);
 if (result != 0 && errno != EEXIST) {
            ALOGE("Failed to create dalvik-cache directory %s: %s", nameBuf, strerror(errno));
 return NULL;
 }
 }

 
     /* Tack on the file name for the actual cache file path.
      */
    strncat(nameBuf, absoluteFile, kBufLen);
 
     ALOGV("Cache file for '%s' '%s' is '%s'", fileName, subFileName, nameBuf);
     return strdup(nameBuf);
}
Commit message: None
CVE: CVE-2016-3757
CWE: CWE-20
Vulnerability description: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.

Project: Android

 static void print_maps(struct pid_info_t* info)
 {
     FILE *maps;
     size_t offset;
     char device[10];
     long int inode;
    char file[PATH_MAX];
 
     strlcat(info->path, "maps", sizeof(info->path));
 
    maps = fopen(info->path, "r");

     if (!maps)
         goto out;
 
    while (fscanf(maps, "%*x-%*x %*s %zx %s %ld %s\n", &offset, device, &inode,
            file) == 4) {
         if (inode == 0 || !strcmp(device, "00:00"))
             continue;

        printf("%-9s %5d %10s %4s %9s %18s %9zd %10ld %s\n",
                info->cmdline, info->pid, info->user, "mem",
 "???", device, offset, inode, file);
 }

    fclose(maps);

out:
    info->path[info->parent_length] = '\0';
}
Commit message: None
CVE: CVE-2016-3754
CWE: CWE-399
Vulnerability description: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not limit process-memory usage, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28615448.

Project: Android

 int main(int argc __unused, char** argv)
 {
     signal(SIGPIPE, SIG_IGN);
     char value[PROPERTY_VALUE_MAX];
     bool doLog = (property_get("ro.test_harness", value, "0") > 0) && (atoi(value) == 1);
 pid_t childPid;
 if (doLog && (childPid = fork()) != 0) {
        strcpy(argv[0], "media.log");
        sp<ProcessState> proc(ProcessState::self());
 MediaLogService::instantiate();
 ProcessState::self()->startThreadPool();
 for (;;) {
 siginfo_t info;
 int ret = waitid(P_PID, childPid, &info, WEXITED | WSTOPPED | WCONTINUED);
 if (ret == EINTR) {
 continue;
 }
 if (ret < 0) {
 break;
 }
 char buffer[32];
 const char *code;
 switch (info.si_code) {
 case CLD_EXITED:
                code = "CLD_EXITED";
 break;
 case CLD_KILLED:
                code = "CLD_KILLED";
 break;
 case CLD_DUMPED:
                code = "CLD_DUMPED";
 break;
 case CLD_STOPPED:
                code = "CLD_STOPPED";
 break;
 case CLD_TRAPPED:
                code = "CLD_TRAPPED";
 break;
 case CLD_CONTINUED:
                code = "CLD_CONTINUED";
 break;
 default:
                snprintf(buffer, sizeof(buffer), "unknown (%d)", info.si_code);
                code = buffer;
 break;
 }
 struct rusage usage;
            getrusage(RUSAGE_CHILDREN, &usage);
            ALOG(LOG_ERROR, "media.log", "pid %d status %d code %s user %ld.%03lds sys %ld.%03lds",
                    info.si_pid, info.si_status, code,
                    usage.ru_utime.tv_sec, usage.ru_utime.tv_usec / 1000,
                    usage.ru_stime.tv_sec, usage.ru_stime.tv_usec / 1000);
            sp<IServiceManager> sm = defaultServiceManager();
            sp<IBinder> binder = sm->getService(String16("media.log"));
 if (binder != 0) {
 Vector<String16> args;
                binder->dump(-1, args);
 }
 switch (info.si_code) {
 case CLD_EXITED:
 case CLD_KILLED:
 case CLD_DUMPED: {
                ALOG(LOG_INFO, "media.log", "exiting");
                _exit(0);
 }
 default:
 break;
 }
 }
 } else {
 if (doLog) {
            prctl(PR_SET_PDEATHSIG, SIGKILL); // if parent media.log dies before me, kill me also
            setpgid(0, 0); // but if I die first, don't kill my parent
 }
 InitializeIcuOrDie();
        sp<ProcessState> proc(ProcessState::self());
        sp<IServiceManager> sm = defaultServiceManager();
        ALOGI("ServiceManager: %p", sm.get());
 AudioFlinger::instantiate();
 MediaPlayerService::instantiate();
 ResourceManagerService::instantiate();
 CameraService::instantiate();
 AudioPolicyService::instantiate();
 SoundTriggerHwService::instantiate();
 RadioService::instantiate();
        registerExtensions();
 ProcessState::self()->startThreadPool();
 IPCThreadState::self()->joinThreadPool();
 }
}
Commit message: None
CVE: CVE-2016-3750
CWE: CWE-20
Vulnerability description: libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a crafted application, aka internal bug 28395952.

Project: Android

native_handle* Parcel::readNativeHandle() const
{
 int numFds, numInts;
 status_t err;
    err = readInt32(&numFds);
 if (err != NO_ERROR) return 0;
    err = readInt32(&numInts);
 if (err != NO_ERROR) return 0;

    native_handle* h = native_handle_create(numFds, numInts);
 if (!h) {
 return 0;
 }

 
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
        if (h->data[i] < 0) err = BAD_VALUE;
     }
     err = read(h->data + numFds, sizeof(int)*numInts);
     if (err != NO_ERROR) {
        native_handle_close(h);
        native_handle_delete(h);
        h = 0;
 }
 return h;
}
Commit message: None
CVE: CVE-2016-3744
CWE: CWE-119
Vulnerability description: Buffer overflow in the create_pbuf function in btif/src/btif_hh.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows remote attackers to gain privileges via a crafted pairing operation, aka internal bug 27930580.

Project: Android

 static BT_HDR *create_pbuf(UINT16 len, UINT8 *data)
 {
    BT_HDR* p_buf = GKI_getbuf((UINT16) (len + BTA_HH_MIN_OFFSET + sizeof(BT_HDR)));
 
     if (p_buf) {
         UINT8* pbuf_data;

        p_buf->len = len;
        p_buf->offset = BTA_HH_MIN_OFFSET;

        pbuf_data = (UINT8*) (p_buf + 1) + p_buf->offset;
        memcpy(pbuf_data, data, len);
 }
 return p_buf;
}
Commit message: None
CVE: CVE-2016-2505
CWE: CWE-119
Vulnerability description: mpeg2ts/ATSParser.cpp in libstagefright in mediaserver in Android 6.x before 2016-07-01 does not validate a certain section length, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28333006.

Project: Android

bool ATSParser::PSISection::isCRCOkay() const {
 if (!isComplete()) {
 return false;
 }
 uint8_t* data = mBuffer->data();

 if ((data[1] & 0x80) == 0) {
 return true;
 }


     unsigned sectionLength = U16_AT(data + 1) & 0xfff;
     ALOGV("sectionLength %u, skip %u", sectionLength, mSkipBytes);
 
     sectionLength -= mSkipBytes;
 
 uint32_t crc = 0xffffffff;
 for(unsigned i = 0; i < sectionLength + 4 /* crc */; i++) {
 uint8_t b = data[i];
 int index = ((crc >> 24) ^ (b & 0xff)) & 0xff;
        crc = CRC_TABLE[index] ^ (crc << 8);
 }
    ALOGV("crc: %08x\n", crc);
 return (crc == 0);
}
Commit message: None
CVE: CVE-2016-2499
CWE: CWE-200
Vulnerability description: AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 27855172.

Project: Android

AudioSource::AudioSource(
 audio_source_t inputSource, const String16 &opPackageName,
 uint32_t sampleRate, uint32_t channelCount, uint32_t outSampleRate)

     : mStarted(false),
       mSampleRate(sampleRate),
       mOutSampleRate(outSampleRate > 0 ? outSampleRate : sampleRate),
       mPrevSampleTimeUs(0),
       mFirstSampleTimeUs(-1ll),
       mNumFramesReceived(0),
       mNumClientOwnedBuffers(0) {
     ALOGV("sampleRate: %u, outSampleRate: %u, channelCount: %u",
            sampleRate, outSampleRate, channelCount);
    CHECK(channelCount == 1 || channelCount == 2);
    CHECK(sampleRate > 0);

 size_t minFrameCount;
 status_t status = AudioRecord::getMinFrameCount(&minFrameCount,
                                           sampleRate,
                                           AUDIO_FORMAT_PCM_16_BIT,
                                           audio_channel_in_mask_from_count(channelCount));
 if (status == OK) {
 uint32_t frameCount = kMaxBufferSize / sizeof(int16_t) / channelCount;

 size_t bufCount = 2;
 while ((bufCount * frameCount) < minFrameCount) {
            bufCount++;
 }

        mRecord = new AudioRecord(
                    inputSource, sampleRate, AUDIO_FORMAT_PCM_16_BIT,
                    audio_channel_in_mask_from_count(channelCount),
                    opPackageName,
 (size_t) (bufCount * frameCount),
 AudioRecordCallbackFunction,
 this,
                    frameCount /*notificationFrames*/);
        mInitCheck = mRecord->initCheck();
 if (mInitCheck != OK) {
            mRecord.clear();
 }
 } else {
        mInitCheck = status;
 }
}
Commit message: None
CVE: CVE-2016-2494
CWE: CWE-264
Vulnerability description: Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28085658.

Project: Android

static ssize_t get_node_path_locked(struct node* node, char* buf, size_t bufsize) {
 const char* name;
 size_t namelen;
 if (node->graft_path) {
        name = node->graft_path;
        namelen = node->graft_pathlen;
 } else if (node->actual_name) {
        name = node->actual_name;
        namelen = node->namelen;
 } else {
        name = node->name;
        namelen = node->namelen;
 }

 if (bufsize < namelen + 1) {
 return -1;
 }

 
     ssize_t pathlen = 0;
     if (node->parent && node->graft_path == NULL) {
        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 2);
         if (pathlen < 0) {
             return -1;
         }
        buf[pathlen++] = '/';
 }

    memcpy(buf + pathlen, name, namelen + 1); /* include trailing \0 */
 return pathlen + namelen;
}
Commit message: None
CVE: CVE-2016-2449
CWE: CWE-264
Vulnerability description: services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27568958.

Project: Android

status_t Camera3Device::createDefaultRequest(int templateId,

         CameraMetadata *request) {
     ATRACE_CALL();
     ALOGV("%s: for template %d", __FUNCTION__, templateId);
     Mutex::Autolock il(mInterfaceLock);
     Mutex::Autolock l(mLock);
 
 switch (mStatus) {
 case STATUS_ERROR:
            CLOGE("Device has encountered a serious error");
 return INVALID_OPERATION;
 case STATUS_UNINITIALIZED:
            CLOGE("Device is not initialized!");
 return INVALID_OPERATION;
 case STATUS_UNCONFIGURED:
 case STATUS_CONFIGURED:
 case STATUS_ACTIVE:
 break;
 default:
            SET_ERR_L("Unexpected status: %d", mStatus);
 return INVALID_OPERATION;
 }

 if (!mRequestTemplateCache[templateId].isEmpty()) {
 *request = mRequestTemplateCache[templateId];
 return OK;
 }

 const camera_metadata_t *rawRequest;
    ATRACE_BEGIN("camera3->construct_default_request_settings");
    rawRequest = mHal3Device->ops->construct_default_request_settings(
        mHal3Device, templateId);
    ATRACE_END();
 if (rawRequest == NULL) {
        ALOGI("%s: template %d is not supported on this camera device",
              __FUNCTION__, templateId);
 return BAD_VALUE;
 }
 *request = rawRequest;
    mRequestTemplateCache[templateId] = rawRequest;

 return OK;
}
Commit message: None
CVE: CVE-2016-2439
CWE: CWE-119
Vulnerability description: Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.

Project: Android

bt_status_t btif_dm_pin_reply( const bt_bdaddr_t *bd_addr, uint8_t accept,

                                uint8_t pin_len, bt_pin_code_t *pin_code)
 {
     BTIF_TRACE_EVENT("%s: accept=%d", __FUNCTION__, accept);
    if (pin_code == NULL)
         return BT_STATUS_FAIL;
 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
 
 if (pairing_cb.is_le_only)
 {
 int i;
        UINT32 passkey = 0;
 int multi[] = {100000, 10000, 1000, 100, 10,1};
        BD_ADDR remote_bd_addr;
        bdcpy(remote_bd_addr, bd_addr->address);
 for (i = 0; i < 6; i++)
 {
            passkey += (multi[i] * (pin_code->pin[i] - '0'));
 }
        BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
        BTA_DmBlePasskeyReply(remote_bd_addr, accept, passkey);

 }
 else
 {
        BTA_DmPinReply( (UINT8 *)bd_addr->address, accept, pin_len, pin_code->pin);
 if (accept)
            pairing_cb.pin_code_len = pin_len;
 }
#else
    BTA_DmPinReply( (UINT8 *)bd_addr->address, accept, pin_len, pin_code->pin);

 if (accept)
        pairing_cb.pin_code_len = pin_len;
#endif
 return BT_STATUS_SUCCESS;
}
Commit message: None
CVE: CVE-2016-2420
CWE: CWE-264
Vulnerability description: rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.

Project: Android

char* engrave_tombstone(pid_t pid, pid_t tid, int signal, int original_si_code,
 uintptr_t abort_msg_address, bool dump_sibling_threads,
 bool* detach_failed, int* total_sleep_time_usec) {

 log_t log;

   log.current_tid = tid;
   log.crashed_tid = tid;
 
  if ((mkdir(TOMBSTONE_DIR, 0755) == -1) && (errno != EEXIST)) {
    _LOG(&log, logtype::ERROR, "failed to create %s: %s\n", TOMBSTONE_DIR, strerror(errno));
  }
  if (chown(TOMBSTONE_DIR, AID_SYSTEM, AID_SYSTEM) == -1) {
    _LOG(&log, logtype::ERROR, "failed to change ownership of %s: %s\n", TOMBSTONE_DIR, strerror(errno));
  }
   int fd = -1;
  char* path = NULL;
  if (selinux_android_restorecon(TOMBSTONE_DIR, 0) == 0) {
    path = find_and_open_tombstone(&fd);
  } else {
    _LOG(&log, logtype::ERROR, "Failed to restore security context, not writing tombstone.\n");
  }
 
   if (fd < 0) {
     _LOG(&log, logtype::ERROR, "Skipping tombstone write, nothing to do.\n");
 *detach_failed = false;
 return NULL;
 }

  log.tfd = fd;
 int amfd = activity_manager_connect();
  log.amfd = amfd;
 *detach_failed = dump_crash(&log, pid, tid, signal, original_si_code, abort_msg_address,
                              dump_sibling_threads, total_sleep_time_usec);

  ALOGI("\nTombstone written to: %s\n", path);

  close(amfd);
  close(fd);

 return path;
}
Commit message: None
CVE: CVE-2016-2416
CWE: CWE-264
Vulnerability description: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.

Project: Android

void BufferQueueConsumer::dump(String8& result, const char* prefix) const {
 const IPCThreadState* ipc = IPCThreadState::self();
 const pid_t pid = ipc->getCallingPid();
 const uid_t uid = ipc->getCallingUid();
 if ((uid != AID_SHELL)
 && !PermissionCache::checkPermission(String16(

             "android.permission.DUMP"), pid, uid)) {
         result.appendFormat("Permission Denial: can't dump BufferQueueConsumer "
                 "from pid=%d, uid=%d\n", pid, uid);
     } else {
         mCore->dump(result, prefix);
     }
}
Commit message: None
CVE: CVE-2016-1503
CWE: CWE-119
Vulnerability description: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.

Project: Android

valid_length(uint8_t option, int dl, int *type)
{
 const struct dhcp_opt *opt;
 ssize_t sz;

 if (dl == 0)
 return -1;

 for (opt = dhcp_opts; opt->option; opt++) {
 if (opt->option != option)
 continue;

 
 		if (type)
 			*type = opt->type;
 		if (opt->type == 0 ||
 		    opt->type & (STRING | RFC3442 | RFC5969))
 			return 0;
 		sz = 0;
		if (opt->type & (UINT32 | IPV4))
 			sz = sizeof(uint32_t);
		if (opt->type & UINT16)
 			sz = sizeof(uint16_t);
		if (opt->type & UINT8)
 			sz = sizeof(uint8_t);
		if (opt->type & (IPV4 | ARRAY))
			return dl % sz;
		return (dl == sz ? 0 : -1);
 	}
 
 	/* unknown option, so let it pass */
 return 0;
}
Commit message: None
CVE: CVE-2016-0846
CWE: CWE-264
Vulnerability description: libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.

Project: Android

sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const
{
 if (mHeap == 0) {
 Parcel data, reply;
        data.writeInterfaceToken(IMemory::getInterfaceDescriptor());
 if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) {
            sp<IBinder> heap = reply.readStrongBinder();
 ssize_t o = reply.readInt32();
 size_t s = reply.readInt32();

             if (heap != 0) {
                 mHeap = interface_cast<IMemoryHeap>(heap);
                 if (mHeap != 0) {
                    mOffset = o;
                    mSize = s;
                 }
             }
         }
     }
     if (offset) *offset = mOffset;
     if (size) *size = mSize;
    return mHeap;
 }