db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2018-9491
CWE: CWE-190
Vulnerability description: In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111603051

Project: Android

AMediaCodecCryptoInfo *AMediaCodecCryptoInfo_new(
 int numsubsamples,
 uint8_t key[16],
 uint8_t iv[16],
 cryptoinfo_mode_t mode,
 size_t *clearbytes,

         size_t *encryptedbytes) {
 
    size_t cryptosize = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2;
     AMediaCodecCryptoInfo *ret = (AMediaCodecCryptoInfo*) malloc(cryptosize);
     if (!ret) {
         ALOGE("couldn't allocate %zu bytes", cryptosize);
 return NULL;
 }
    ret->numsubsamples = numsubsamples;
    memcpy(ret->key, key, 16);
    memcpy(ret->iv, iv, 16);
    ret->mode = mode;
    ret->pattern.encryptBlocks = 0;
    ret->pattern.skipBlocks = 0;

    ret->clearbytes = (size_t*) (ret + 1); // point immediately after the struct
    ret->encryptedbytes = ret->clearbytes + numsubsamples; // point after the clear sizes

    memcpy(ret->clearbytes, clearbytes, numsubsamples * sizeof(size_t));
    memcpy(ret->encryptedbytes, encryptedbytes, numsubsamples * sizeof(size_t));

 return ret;
}
Commit message: None
CVE: CVE-2018-9490
CWE: CWE-704
Vulnerability description: In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111274046

Project: Android

 static Maybe<bool> CollectValuesOrEntriesImpl(

       Isolate* isolate, Handle<JSObject> object,
       Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
       PropertyFilter filter) {
    int count = 0;
     KeyAccumulator accumulator(isolate, KeyCollectionMode::kOwnOnly,
                                ALL_PROPERTIES);
     Subclass::CollectElementIndicesImpl(
         object, handle(object->elements(), isolate), &accumulator);
     Handle<FixedArray> keys = accumulator.GetKeys();
 
    for (int i = 0; i < keys->length(); ++i) {
       Handle<Object> key(keys->get(i), isolate);
      Handle<Object> value;
       uint32_t index;
       if (!key->ToUint32(&index)) continue;
 
       uint32_t entry = Subclass::GetEntryForIndexImpl(
           isolate, *object, object->elements(), index, filter);
       if (entry == kMaxUInt32) continue;
 
       PropertyDetails details = Subclass::GetDetailsImpl(*object, entry);
 
       if (details.kind() == kData) {
         value = Subclass::GetImpl(isolate, object->elements(), entry);
       } else {
         LookupIterator it(isolate, object, index, LookupIterator::OWN);
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
             isolate, value, Object::GetProperty(&it), Nothing<bool>());
       }
      if (get_entries) {
        value = MakeEntryPair(isolate, index, value);
       }
       values_or_entries->set(count++, *value);
     }
 
 *nof_items = count;
 return Just(true);
 }
Commit message: None
CVE: CVE-2017-13200
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63100526.

Project: Android

bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
 size_t oldSize = mSize;

 size_t offset = 0;
 while (mSize >= 10 && offset <= mSize - 10) {
 if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
 break;
 }

 size_t dataSize;
 if (iTunesHack) {
            dataSize = U32_AT(&mData[offset + 4]);
 } else if (!ParseSyncsafeInteger(&mData[offset + 4], &dataSize)) {
 return false;
 }

 if (dataSize > mSize - 10 - offset) {
 return false;
 }

 uint16_t flags = U16_AT(&mData[offset + 8]);
 uint16_t prevFlags = flags;

 if (flags & 1) {

 if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
 return false;
 }
            memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
            mSize -= 4;
            dataSize -= 4;

            flags &= ~1;
 }

 if ((flags & 2) && (dataSize >= 2)) {

 size_t readOffset = offset + 11;
 size_t writeOffset = offset + 11;
 for (size_t i = 0; i + 1 < dataSize; ++i) {
 if (mData[readOffset - 1] == 0xff
 && mData[readOffset] == 0x00) {
 ++readOffset;

                     --mSize;
                     --dataSize;
                 }
                mData[writeOffset++] = mData[readOffset++];
             }
             if (readOffset <= oldSize) {
                memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);
 } else {
                ALOGE("b/34618607 (%zu %zu %zu %zu)", readOffset, writeOffset, oldSize, mSize);
                android_errorWriteLog(0x534e4554, "34618607");
 }

 }
        flags &= ~2;
 if (flags != prevFlags || iTunesHack) {
 WriteSyncsafeInteger(&mData[offset + 4], dataSize);
            mData[offset + 8] = flags >> 8;
            mData[offset + 9] = flags & 0xff;
 }

        offset += 10 + dataSize;
 }

    memset(&mData[mSize], 0, oldSize - mSize);

 return true;
}
Commit message: None
CVE: CVE-2017-13190
CWE: CWE-770
Vulnerability description: A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68299873.

Project: Android

WORD32 ihevcd_create(iv_obj_t *ps_codec_obj,

                            void *pv_api_ip,
                            void *pv_api_op)
 {
     ihevcd_cxa_create_op_t *ps_create_op;
 
     WORD32 ret;
     codec_t *ps_codec;
     ps_create_op = (ihevcd_cxa_create_op_t *)pv_api_op;
 
     ps_create_op->s_ivd_create_op_t.u4_error_code = 0;
     ret = ihevcd_allocate_static_bufs(&ps_codec_obj, pv_api_ip, pv_api_op);
 
     /* If allocation of some buffer fails, then free buffers allocated till then */
    if((IV_FAIL == ret) && (NULL != ps_codec_obj))
     {
        ihevcd_free_static_bufs(ps_codec_obj);
         ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
         ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
 
 return IV_FAIL;
 }
    ps_codec = (codec_t *)ps_codec_obj->pv_codec_handle;
    ret = ihevcd_init(ps_codec);

    TRACE_INIT(NULL);
    STATS_INIT();

 return ret;
}
Commit message: None
CVE: CVE-2017-13189
CWE: CWE-770
Vulnerability description: A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68300072.

Project: Android

 WORD32 ih264d_create(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 {
     ih264d_create_op_t *ps_create_op;
 
     WORD32 ret;
 
     ps_create_op = (ih264d_create_op_t *)pv_api_op;
 
     ps_create_op->s_ivd_create_op_t.u4_error_code = 0;
     ret = ih264d_allocate_static_bufs(&dec_hdl, pv_api_ip, pv_api_op);
 
     /* If allocation of some buffer fails, then free buffers allocated till then */
    if((IV_FAIL == ret) && (NULL != dec_hdl))
     {
        ih264d_free_static_bufs(dec_hdl);
         ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
         ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
 
 return IV_FAIL;
 }

 return IV_SUCCESS;
}
Commit message: None
CVE: CVE-2017-7376
CWE: CWE-119
Vulnerability description: Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

Project: Android

xmlParse3986Port(xmlURIPtr uri, const char **str)
{
 const char *cur = *str;
 unsigned port = 0; /* unsigned for defined overflow behavior */

 if (ISA_DIGIT(cur)) {
 while (ISA_DIGIT(cur)) {
	    port = port * 10 + (*cur - '0');


 	    cur++;
 	}
 	if (uri != NULL)
	    uri->port = port & INT_MAX; /* port value modulo INT_MAX+1 */
 	*str = cur;
 	return(0);
     }
 return(1);
}
Commit message: None
CVE: CVE-2015-3849
CWE: CWE-264
Vulnerability description: The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.

Project: Android

static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
{
 if (parcel == NULL) {
 return NULL;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 const size_t size = p->readInt32();
 const void* regionData = p->readInplace(size);
 if (regionData == NULL) {

         return NULL;
     }
     SkRegion* region = new SkRegion;
    region->readFromMemory(regionData, size);
 
     return reinterpret_cast<jlong>(region);
 }
Commit message: None
CVE: CVE-2015-3835
CWE: CWE-119
Vulnerability description: Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.

Project: Android

status_t OMXNodeInstance::emptyBuffer(
        OMX::buffer_id buffer,
        OMX_U32 rangeOffset, OMX_U32 rangeLength,
        OMX_U32 flags, OMX_TICKS timestamp) {

     Mutex::Autolock autoLock(mLock);
 
     OMX_BUFFERHEADERTYPE *header = findBufferHeader(buffer);
     header->nFilledLen = rangeLength;
     header->nOffset = rangeOffset;
 
 BufferMeta *buffer_meta =
 static_cast<BufferMeta *>(header->pAppPrivate);
    buffer_meta->CopyToOMX(header);

 return emptyBuffer_l(header, flags, timestamp, (intptr_t)buffer);
}
Commit message: None
CVE: CVE-2015-1528
CWE: CWE-189
Vulnerability description: Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.

Project: Android

 native_handle_t* native_handle_create(int numFds, int numInts)
 {
    native_handle_t* h = malloc(
            sizeof(native_handle_t) + sizeof(int)*(numFds+numInts));
 
     if (h) {
         h->version = sizeof(native_handle_t);
         h->numFds = numFds;
        h->numInts = numInts;
 }
 return h;
}
Commit message: None
CVE: CVE-2016-6720
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-29422020.

Project: Android

status_t OMXNodeInstance::allocateBufferWithBackup(
        OMX_U32 portIndex, const sp<IMemory> &params,
        OMX::buffer_id *buffer, OMX_U32 allottedSize) {
 if (params == NULL || buffer == NULL) {
        ALOGE("b/25884056");
 return BAD_VALUE;
 }

 Mutex::Autolock autoLock(mLock);
 if (allottedSize > params->size() || portIndex >= NELEM(mNumPortBuffers)) {
 return BAD_VALUE;
 }

 bool copy = mMetadataType[portIndex] == kMetadataBufferTypeInvalid;

 BufferMeta *buffer_meta = new BufferMeta(
            params, portIndex,
 (portIndex == kPortIndexInput) && copy /* copyToOmx */,
 (portIndex == kPortIndexOutput) && copy /* copyFromOmx */,
            NULL /* data */);

    OMX_BUFFERHEADERTYPE *header;

    OMX_ERRORTYPE err = OMX_AllocateBuffer(
            mHandle, &header, portIndex, buffer_meta, allottedSize);
 if (err != OMX_ErrorNone) {
        CLOG_ERROR(allocateBufferWithBackup, err,
                SIMPLE_BUFFER(portIndex, (size_t)allottedSize, params->pointer()));
 delete buffer_meta;
        buffer_meta = NULL;

 *buffer = 0;

 return StatusFromOMXError(err);

     }
 
     CHECK_EQ(header->pAppPrivate, buffer_meta);
    memset(header->pBuffer, 0, header->nAllocLen);
 
     *buffer = makeBufferID(header);
 
    addActiveBuffer(portIndex, *buffer);

    sp<GraphicBufferSource> bufferSource(getGraphicBufferSource());
 if (bufferSource != NULL && portIndex == kPortIndexInput) {
        bufferSource->addCodecBuffer(header);
 }

    CLOG_BUFFER(allocateBufferWithBackup, NEW_BUFFER_FMT(*buffer, portIndex, "%zu@%p :> %u@%p",
            params->size(), params->pointer(), allottedSize, header->pBuffer));

 return OK;
}
Commit message: None
CVE: CVE-2016-3900
CWE: CWE-264
Vulnerability description: cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka internal bug 29431260.

Project: Android

 static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)
 {
     const char *perm = "add";
     return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
 }
Commit message: None
CVE: CVE-2016-3872
CWE: CWE-119
Vulnerability description: Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to gain privileges via a crafted application, aka internal bug 29421675.

Project: Android

bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *portWillReset) {
 List<BufferInfo *> &outQueue = getPortQueue(1);
 BufferInfo *outInfo = NULL;
    OMX_BUFFERHEADERTYPE *outHeader = NULL;
 vpx_codec_iter_t iter = NULL;

 if (flushDecoder && mFrameParallelMode) {
 if (vpx_codec_decode((vpx_codec_ctx_t *)mCtx, NULL, 0, NULL, 0)) {
            ALOGE("Failed to flush on2 decoder.");
 return false;
 }
 }

 if (!display) {
 if (!flushDecoder) {
            ALOGE("Invalid operation.");
 return false;
 }
 while ((mImg = vpx_codec_get_frame((vpx_codec_ctx_t *)mCtx, &iter))) {
 }
 return true;
 }

 while (!outQueue.empty()) {
 if (mImg == NULL) {
            mImg = vpx_codec_get_frame((vpx_codec_ctx_t *)mCtx, &iter);
 if (mImg == NULL) {
 break;
 }
 }
 uint32_t width = mImg->d_w;
 uint32_t height = mImg->d_h;
        outInfo = *outQueue.begin();
        outHeader = outInfo->mHeader;
        CHECK_EQ(mImg->fmt, VPX_IMG_FMT_I420);
        handlePortSettingsChange(portWillReset, width, height);
 if (*portWillReset) {
 return true;
 }

        outHeader->nOffset = 0;

         outHeader->nFlags = 0;
         outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;
         outHeader->nTimeStamp = *(OMX_TICKS *)mImg->user_priv;
        if (outHeader->nAllocLen >= outHeader->nFilledLen) {
             uint8_t *dst = outHeader->pBuffer;
             const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];
             const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
 const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V];
 size_t srcYStride = mImg->stride[VPX_PLANE_Y];
 size_t srcUStride = mImg->stride[VPX_PLANE_U];

             size_t srcVStride = mImg->stride[VPX_PLANE_V];
             copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
         } else {
            ALOGE("b/27597103, buffer too small");
            android_errorWriteLog(0x534e4554, "27597103");
             outHeader->nFilledLen = 0;
         }
 
        mImg = NULL;
        outInfo->mOwnedByUs = false;
        outQueue.erase(outQueue.begin());
        outInfo = NULL;
        notifyFillBufferDone(outHeader);
        outHeader = NULL;
 }

 if (!eos) {
 return true;
 }

 if (!outQueue.empty()) {
        outInfo = *outQueue.begin();
        outQueue.erase(outQueue.begin());
        outHeader = outInfo->mHeader;
        outHeader->nTimeStamp = 0;
        outHeader->nFilledLen = 0;
        outHeader->nFlags = OMX_BUFFERFLAG_EOS;
        outInfo->mOwnedByUs = false;
        notifyFillBufferDone(outHeader);
        mEOSStatus = OUTPUT_FRAMES_FLUSHED;
 }

     return true;
 }
Commit message: None
CVE: CVE-2016-3871
CWE: CWE-264
Vulnerability description: Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application, aka internal bug 29422022.

Project: Android

 void *SoftMP3::memsetSafe(OMX_BUFFERHEADERTYPE *outHeader, int c, size_t len) {
     if (len > outHeader->nAllocLen) {
        ALOGE("memset buffer too small: got %lu, expected %zu", (unsigned long)outHeader->nAllocLen, len);
         android_errorWriteLog(0x534e4554, "29422022");
         notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
         mSignalledError = true;
 return NULL;
 }
 return memset(outHeader->pBuffer, c, len);
}
Commit message: None
CVE: CVE-2016-3871
CWE: CWE-264
Vulnerability description: Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application, aka internal bug 29422022.

Project: Android

 void *SoftMP3::memsetSafe(OMX_BUFFERHEADERTYPE *outHeader, int c, size_t len) {
     if (len > outHeader->nAllocLen) {
        ALOGE("memset buffer too small: got %lu, expected %zu", outHeader->nAllocLen, len);
         android_errorWriteLog(0x534e4554, "29422022");
         notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
         mSignalledError = true;
 return NULL;
 }
 return memset(outHeader->pBuffer, c, len);
}
Commit message: None
CVE: CVE-2016-3861
CWE: CWE-119
Vulnerability description: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

Project: Android

status_t Parcel::readUtf8FromUtf16(std::string* str) const {
 size_t utf16Size = 0;
 const char16_t* src = readString16Inplace(&utf16Size);
 if (!src) {
 return UNEXPECTED_NULL;
 }

 if (utf16Size == 0u) {
        str->clear();

        return NO_ERROR;
     }
 
    ssize_t utf8Size = utf16_to_utf8_length(src, utf16Size);
    if (utf8Size < 0) {
         return BAD_VALUE;
     }
    str->resize(utf8Size + 1);
    utf16_to_utf8(src, utf16Size, &((*str)[0]));
     str->resize(utf8Size);
     return NO_ERROR;
 }
Commit message: None
CVE: CVE-2016-3861
CWE: CWE-119
Vulnerability description: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

Project: Android

void unmarshallAudioAttributes(const Parcel& parcel, audio_attributes_t *attributes)
{
    attributes->usage = (audio_usage_t) parcel.readInt32();
    attributes->content_type = (audio_content_type_t) parcel.readInt32();
    attributes->source = (audio_source_t) parcel.readInt32();
    attributes->flags = (audio_flags_mask_t) parcel.readInt32();
 const bool hasFlattenedTag = (parcel.readInt32() == kAudioAttributesMarshallTagFlattenTags);
 if (hasFlattenedTag) {
 String16 tags = parcel.readString16();
 ssize_t realTagSize = utf16_to_utf8_length(tags.string(), tags.size());
 if (realTagSize <= 0) {
            strcpy(attributes->tags, "");
 } else {

             size_t tagSize = realTagSize > AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 ?
                     AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 : realTagSize;
            utf16_to_utf8(tags.string(), tagSize, attributes->tags);
         }
     } else {
         ALOGE("unmarshallAudioAttributes() received unflattened tags, ignoring tag values");
        strcpy(attributes->tags, "");
 }
}
Commit message: None
CVE: CVE-2016-3861
CWE: CWE-119
Vulnerability description: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

Project: Android

std::string utf16ToUtf8(const StringPiece16& utf16) {
 ssize_t utf8Length = utf16_to_utf8_length(utf16.data(), utf16.length());
 if (utf8Length <= 0) {
 return {};

     }
 
     std::string utf8;
     utf8.resize(utf8Length);
    utf16_to_utf8(utf16.data(), utf16.length(), &*utf8.begin());
     return utf8;
 }
Commit message: None
CVE: CVE-2016-3760
CWE: CWE-20
Vulnerability description: Bluetooth in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows local users to gain privileges by establishing a pairing that remains present during a session of the primary user, aka internal bug 27410683.

Project: Android

static jboolean enableNative(JNIEnv* env, jobject obj) {
     ALOGV("%s:",__FUNCTION__);
 
     jboolean result = JNI_FALSE;
     if (!sBluetoothInterface) return result;
    int ret = sBluetoothInterface->enable();
     result = (ret == BT_STATUS_SUCCESS || ret == BT_STATUS_DONE) ? JNI_TRUE : JNI_FALSE;
     return result;
 }
Commit message: None
CVE: CVE-2016-2508
CWE: CWE-119
Vulnerability description: media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate certain track data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28799341.

Project: Android

 status_t NuPlayer::GenericSource::setBuffers(
         bool audio, Vector<MediaBuffer *> &buffers) {
    if (mIsWidevine && !audio && mVideoTrack.mSource != NULL) {
         return mVideoTrack.mSource->setBuffers(buffers);
     }
     return INVALID_OPERATION;
}
Commit message: None
CVE: CVE-2016-2464
CWE: CWE-20
Vulnerability description: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.

Project: Android

long ParseElementHeader(IMkvReader* pReader, long long& pos,
 long long stop, long long& id,
 long long& size) {
 if (stop >= 0 && pos >= stop)
 return E_FILE_FORMAT_INVALID;

 long len;

  id = ReadID(pReader, pos, len);

 if (id < 0)
 return E_FILE_FORMAT_INVALID;

  pos += len; // consume id

 if (stop >= 0 && pos >= stop)
 return E_FILE_FORMAT_INVALID;

  size = ReadUInt(pReader, pos, len);

 if (size < 0 || len < 1 || len > 8) {
 return E_FILE_FORMAT_INVALID;
 }

 const unsigned long long rollover_check =
 static_cast<unsigned long long>(pos) + len;
 if (rollover_check > LONG_LONG_MAX)
 return E_FILE_FORMAT_INVALID;

  pos += len; // consume length of size

 
 
  if (stop >= 0 && pos >= stop)
     return E_FILE_FORMAT_INVALID;
 
   return 0;  // success
}