Commit message: None
CVE: CVE-2017-0817
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63522430.

Project: Android

void SimpleSoftOMXComponent::checkTransitions() {
 if (mState != mTargetState) {
 bool transitionComplete = true;

 if (mState == OMX_StateLoaded) {
            CHECK_EQ((int)mTargetState, (int)OMX_StateIdle);

 for (size_t i = 0; i < mPorts.size(); ++i) {
 const PortInfo &port = mPorts.itemAt(i);
 if (port.mDef.bEnabled == OMX_FALSE) {
 continue;
 }

 if (port.mDef.bPopulated == OMX_FALSE) {
                    transitionComplete = false;
 break;
 }
 }
 } else if (mTargetState == OMX_StateLoaded) {
            CHECK_EQ((int)mState, (int)OMX_StateIdle);

 for (size_t i = 0; i < mPorts.size(); ++i) {
 const PortInfo &port = mPorts.itemAt(i);
 if (port.mDef.bEnabled == OMX_FALSE) {
 continue;
 }

 size_t n = port.mBuffers.size();

 if (n > 0) {
                    CHECK_LE(n, port.mDef.nBufferCountActual);

 if (n == port.mDef.nBufferCountActual) {
                        CHECK_EQ((int)port.mDef.bPopulated, (int)OMX_TRUE);
 } else {
                        CHECK_EQ((int)port.mDef.bPopulated, (int)OMX_FALSE);
 }

                    transitionComplete = false;
 break;
 }
 }
 }

 if (transitionComplete) {
            ALOGV("state transition from %d to %d complete", mState, mTargetState);
            mState = mTargetState;

 if (mState == OMX_StateLoaded) {
                onReset();
 }

            notify(OMX_EventCmdComplete, OMX_CommandStateSet, mState, NULL);
 } else {
            ALOGV("state transition from %d to %d not yet complete", mState, mTargetState);
 }
 }

 for (size_t i = 0; i < mPorts.size(); ++i) {
 PortInfo *port = &mPorts.editItemAt(i);

 if (port->mTransition == PortInfo::DISABLING) {
 if (port->mBuffers.empty()) {
                ALOGV("Port %zu now disabled.", i);

                port->mTransition = PortInfo::NONE;
                notify(OMX_EventCmdComplete, OMX_CommandPortDisable, i, NULL);

                onPortEnableCompleted(i, false /* enabled */);
 }
 } else if (port->mTransition == PortInfo::ENABLING) {
 if (port->mDef.bPopulated == OMX_TRUE) {
                ALOGV("Port %zu now enabled.", i);

                port->mTransition = PortInfo::NONE;
                port->mDef.bEnabled = OMX_TRUE;
                notify(OMX_EventCmdComplete, OMX_CommandPortEnable, i, NULL);

                onPortEnableCompleted(i, true /* enabled */);
 }
 }
 }
}

Project: Android

void SimpleSoftOMXComponent::onPortEnable(OMX_U32 portIndex, bool enable) {
    CHECK_LT(portIndex, mPorts.size());

 PortInfo *port = &mPorts.editItemAt(portIndex);
    CHECK_EQ((int)port->mTransition, (int)PortInfo::NONE);
    CHECK(port->mDef.bEnabled == !enable);

 if (port->mDef.eDir != OMX_DirOutput) {
        ALOGE("Port enable/disable allowed only on output ports.");
        notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
        android_errorWriteLog(0x534e4554, "29421804");
 return;
 }

 if (!enable) {
        port->mDef.bEnabled = OMX_FALSE;
        port->mTransition = PortInfo::DISABLING;

 for (size_t i = 0; i < port->mBuffers.size(); ++i) {
 BufferInfo *buffer = &port->mBuffers.editItemAt(i);

 if (buffer->mOwnedByUs) {
                buffer->mOwnedByUs = false;

 if (port->mDef.eDir == OMX_DirInput) {
                    notifyEmptyBufferDone(buffer->mHeader);
 } else {
                    CHECK_EQ(port->mDef.eDir, OMX_DirOutput);
                    notifyFillBufferDone(buffer->mHeader);
 }
 }
 }

        port->mQueue.clear();
 } else {
        port->mTransition = PortInfo::ENABLING;
 }

    checkTransitions();
}