db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2018-6143
CWE: CWE-125
Vulnerability description: Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Project: Chrome

  bool IsShowingAccountChooser() {
    return PasswordsModelDelegateFromWebContents(WebContents())->GetState() ==
           password_manager::ui::CREDENTIAL_REQUEST_STATE;
  }

Project: Chrome

  void TestStoreInUnloadHandlerForCrossSiteNavigation(
      bool preestablish_mojo_pipe) {
    const GURL a_url = https_test_server().GetURL("a.com", "/title1.html");
    const GURL b_url = https_test_server().GetURL("b.com", "/title2.html");

    ui_test_utils::NavigateToURL(browser(), a_url);

    ChromePasswordManagerClient* client =
        ChromePasswordManagerClient::FromWebContents(WebContents());

    if (preestablish_mojo_pipe) {
      EXPECT_FALSE(client->has_binding_for_credential_manager());
      ASSERT_NO_FATAL_FAILURE(
          TriggerNavigatorGetPasswordCredentialsAndExpectHasResult(
              WebContents(), false));
      EXPECT_TRUE(client->has_binding_for_credential_manager());
    }

    ASSERT_NO_FATAL_FAILURE(ScheduleNavigatorStoreCredentialAtUnload(
        WebContents(), "user", "hunter2"));

    content::RenderFrameDeletedObserver rfh_destruction_observer(
        WebContents()->GetMainFrame());
    ui_test_utils::NavigateToURL(browser(), b_url);

    rfh_destruction_observer.WaitUntilDeleted();
    EXPECT_FALSE(client->has_binding_for_credential_manager());
    EXPECT_FALSE(client->was_store_ever_called());
  }

Project: Chrome

PasswordStore* CredentialManagerImpl::GetPasswordStore() {
  return client_ ? client_->GetPasswordStore() : nullptr;
}
Commit message: None
CVE: CVE-2016-1672
CWE: CWE-284
Vulnerability description: The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.

Project: Chrome

ModuleSystem::ModuleSystem(ScriptContext* context, SourceMap* source_map)
    : ObjectBackedNativeHandler(context),
      context_(context),
      source_map_(source_map),
      natives_enabled_(0),
      exception_handler_(new DefaultExceptionHandler(context)),
      weak_factory_(this) {
  RouteFunction(
      "require",
      base::Bind(&ModuleSystem::RequireForJs, base::Unretained(this)));
  RouteFunction(
      "requireNative",
      base::Bind(&ModuleSystem::RequireNative, base::Unretained(this)));
  RouteFunction(
      "requireAsync",
      base::Bind(&ModuleSystem::RequireAsync, base::Unretained(this)));
  RouteFunction("privates",
                base::Bind(&ModuleSystem::Private, base::Unretained(this)));

  v8::Local<v8::Object> global(context->v8_context()->Global());
  v8::Isolate* isolate = context->isolate();
  SetPrivate(global, kModulesField, v8::Object::New(isolate));
  SetPrivate(global, kModuleSystem, v8::External::New(isolate, this));

  gin::ModuleRegistry::From(context->v8_context())->AddObserver(this);
  if (context_->GetRenderFrame()) {
    context_->GetRenderFrame()->EnsureMojoBuiltinsAreAvailable(
        context->isolate(), context->v8_context());
  }
}
Commit message: None
CVE: CVE-2016-1686
CWE: CWE-119
Vulnerability description: The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

Project: Chrome

    TestState()
        : added_input_method_extensions_(), active_input_method_ids_() {}

Project: Chrome

bool IsControlChar(const base::string16& text) {
  const std::string str = base::UTF16ToUTF8(text);
  if (str.length() != 1)
    return false;
  for (const auto& t : kControlCharToKeyEvent) {
    if (str[0] == std::get<0>(t))
      return true;
  }
  return false;
}
Commit message: None
CVE: CVE-2015-3849
CWE: CWE-264
Vulnerability description: The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.

Project: Android

static jboolean RegionIter_next(JNIEnv* env, jobject, jlong pairHandle, jobject rectObject)
{
 RgnIterPair* pair = reinterpret_cast<RgnIterPair*>(pairHandle);
 SkASSERT(pair);
 SkASSERT(rectObject);

 if (!pair->fIter.done()) {
 GraphicsJNI::irect_to_jrect(pair->fIter.rect(), env, rectObject);
        pair->fIter.next();
 return JNI_TRUE;
 }
 return JNI_FALSE;
}

Project: Android

static jboolean Region_quickRejectIIII(JNIEnv* env, jobject region, jint left, jint top, jint right, jint bottom) {
 SkIRect ir;
    ir.set(left, top, right, bottom);
 bool result = GetSkRegion(env, region)->quickReject(ir);
 return boolTojboolean(result);
}

Project: Android

static jboolean Region_writeToParcel(JNIEnv* env, jobject clazz, jlong regionHandle, jobject parcel)
{
 const SkRegion* region = reinterpret_cast<SkRegion*>(regionHandle);
 if (parcel == NULL) {
 return JNI_FALSE;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 size_t size = region->writeToMemory(NULL);
    p->writeInt32(size);
    region->writeToMemory(p->writeInplace(size));

 return JNI_TRUE;
}
Commit message: None
CVE: CVE-2015-3834
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption, leading to a heap-based buffer overflow, aka internal bug 20222489.

Project: Android

 virtual status_t setObserver(const sp<IHDCPObserver> &observer) {
 Parcel data, reply;
        data.writeInterfaceToken(IHDCP::getInterfaceDescriptor());
        data.writeStrongBinder(observer->asBinder());
        remote()->transact(HDCP_SET_OBSERVER, data, &reply);
 return reply.readInt32();
 }
Commit message: None
CVE: CVE-2015-3831
CWE: CWE-119
Vulnerability description: Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.

Project: Android

 BpMediaHTTPConnection(const sp<IBinder> &impl)
 : BpInterface<IMediaHTTPConnection>(impl) {
 }

Project: Android

 virtual void disconnect() {
 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

        remote()->transact(DISCONNECT, data, &reply);
 }
Commit message: None
CVE: CVE-2015-1536
CWE: CWE-189
Vulnerability description: Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.

Project: Android

static jint Bitmap_rowBytes(JNIEnv* env, jobject, jlong bitmapHandle) {
 SkBitmap* bitmap = reinterpret_cast<SkBitmap*>(bitmapHandle);
 return static_cast<jint>(bitmap->rowBytes());
}

Project: Android

static void FromColor_D32(void* dst, const SkColor src[], int width,
 int, int) {
 SkPMColor* d = (SkPMColor*)dst;

 for (int i = 0; i < width; i++) {
 *d++ = SkPreMultiplyColor(*src++);
 }
}

Project: Android

static void FromColor_D565(void* dst, const SkColor src[], int width,
 int x, int y) {
 uint16_t* d = (uint16_t*)dst;

    DITHER_565_SCAN(y);
 for (int stop = x + width; x < stop; x++) {
 SkColor c = *src++;
 *d++ = SkDitherRGBTo565(SkColorGetR(c), SkColorGetG(c), SkColorGetB(c),
                                DITHER_VALUE(x));
 }
}
Commit message: None
CVE: CVE-2016-6712
CWE: CWE-20
Vulnerability description: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.

Project: Android

void vp9_init_context_buffers(VP9_COMMON *cm) {
  cm->setup_mi(cm);
 if (cm->last_frame_seg_map && !cm->frame_parallel_decode)
    memset(cm->last_frame_seg_map, 0, cm->mi_rows * cm->mi_cols);
}
Commit message: None
CVE: CVE-2016-6699
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622.

Project: Android

String8 MediaHTTP::getMIMEType() const {
 if (mInitCheck != OK) {
 return String8("application/octet-stream");
 }

 String8 mimeType;
 status_t err = mHTTPConnection->getMIMEType(&mimeType);

 if (err != OK) {
 return String8("application/octet-stream");
 }

 return mimeType;
}
Commit message: None
CVE: CVE-2016-3900
CWE: CWE-264
Vulnerability description: cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka internal bug 29431260.

Project: Android

void svcinfo_death(struct binder_state *bs, void *ptr)
{
 struct svcinfo *si = (struct svcinfo* ) ptr;

    ALOGI("service '%s' died\n", str8(si->name, si->len));
 if (si->handle) {
        binder_release(bs, si->handle);
        si->handle = 0;
 }
}
Commit message: None
CVE: CVE-2016-3890
CWE: CWE-264
Vulnerability description: The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.

Project: Android

static void local_socket_close(asocket* s) {
    D("entered local_socket_close. LS(%d) fd=%d", s->id, s->fd);
    std::lock_guard<std::recursive_mutex> lock(local_socket_list_lock);
 if (s->peer) {
        D("LS(%d): closing peer. peer->id=%d peer->fd=%d", s->id, s->peer->id, s->peer->fd);
 /* Note: it's important to call shutdown before disconnecting from
         * the peer, this ensures that remote sockets can still get the id
         * of the local socket they're connected to, to send a CLOSE()
         * protocol event. */
 if (s->peer->shutdown) {
            s->peer->shutdown(s->peer);
 }
        s->peer->peer = nullptr;
        s->peer->close(s->peer);
        s->peer = nullptr;
 }

 /* If we are already closing, or if there are no
    ** pending packets, destroy immediately
    */
 if (s->closing || s->has_write_error || s->pkt_first == NULL) {
 int id = s->id;
        local_socket_destroy(s);
        D("LS(%d): closed", id);
 return;
 }

 /* otherwise, put on the closing list
    */
    D("LS(%d): closing", s->id);
    s->closing = 1;
    fdevent_del(&s->fde, FDE_READ);
    remove_socket(s);
    D("LS(%d): put on socket_closing_list fd=%d", s->id, s->fd);
    insert_local_socket(s, &local_socket_closing_list);
    CHECK_EQ(FDE_WRITE, s->fde.state & FDE_WRITE);
}
Commit message: None
CVE: CVE-2016-3871
CWE: CWE-264
Vulnerability description: Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application, aka internal bug 29422022.

Project: Android

android::SoftOMXComponent *createSoftOMXComponent(
 const char *name, const OMX_CALLBACKTYPE *callbacks,
        OMX_PTR appData, OMX_COMPONENTTYPE **component) {
 return new android::SoftMP3(name, callbacks, appData, component);
}
Commit message: None
CVE: CVE-2016-3870
CWE: CWE-264
Vulnerability description: omx/SimpleSoftOMXComponent.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not prevent input-port changes, which allows attackers to gain privileges via a crafted application, aka internal bug 29421804.

Project: Android

OMX_ERRORTYPE SimpleSoftOMXComponent::emptyThisBuffer(
        OMX_BUFFERHEADERTYPE *buffer) {
    sp<AMessage> msg = new AMessage(kWhatEmptyThisBuffer, mHandler);
    msg->setPointer("header", buffer);
    msg->post();

 return OMX_ErrorNone;
}

Project: Android

OMX_ERRORTYPE SimpleSoftOMXComponent::freeBuffer(
        OMX_U32 portIndex,
        OMX_BUFFERHEADERTYPE *header) {
 Mutex::Autolock autoLock(mLock);

    CHECK_LT(portIndex, mPorts.size());

 PortInfo *port = &mPorts.editItemAt(portIndex);

#if 0 // XXX
    CHECK((mState == OMX_StateIdle && mTargetState == OMX_StateLoaded)
 || port->mDef.bEnabled == OMX_FALSE);
#endif

 bool found = false;
 for (size_t i = 0; i < port->mBuffers.size(); ++i) {
 BufferInfo *buffer = &port->mBuffers.editItemAt(i);

 if (buffer->mHeader == header) {
            CHECK(!buffer->mOwnedByUs);

 if (header->pPlatformPrivate != NULL) {
                CHECK(header->pPlatformPrivate == header->pBuffer);

 delete[] header->pBuffer;
                header->pBuffer = NULL;
 }

 delete header;
            header = NULL;

            port->mBuffers.removeAt(i);
            port->mDef.bPopulated = OMX_FALSE;

            checkTransitions();

            found = true;
 break;
 }
 }

    CHECK(found);

 return OMX_ErrorNone;
}

Project: Android

void SimpleSoftOMXComponent::onPortFlushCompleted(OMX_U32 portIndex __unused) {
}
Commit message: None
CVE: CVE-2016-3822
CWE: CWE-119
Vulnerability description: exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.

Project: Android

static void ConvertDoubleToSRational(double value, int *numerator,
 int *denominator) {
 int negative = 0;

 if (value < 0) {
        value = -value;
        negative = 1;
 }

 unsigned int n, d;
    float2urat(value, 0x7FFFFFFFU, &n, &d);
 *numerator = (int)n;
 *denominator = (int)d;
 if (negative) {
 *numerator = -*numerator;
 }
}

Project: Android

int Get16u(void * Short)
{
 if (MotorolaOrder){
 return (((uchar *)Short)[0] << 8) | ((uchar *)Short)[1];
 }else{
 return (((uchar *)Short)[1] << 8) | ((uchar *)Short)[0];
 }
}

Project: Android

int RemoveThumbnail(unsigned char * ExifSection)
{
 if (!DirWithThumbnailPtrs ||
 ImageInfo.ThumbnailOffset == 0 ||
 ImageInfo.ThumbnailSize == 0){
 return 0;
 }
 if (ImageInfo.ThumbnailAtEnd == FALSE){
 ErrNonfatal("Thumbnail is not at end of header, can't chop it off", 0, 0);
 return 0;
 }

 {
 int de;
 int NumDirEntries;
 NumDirEntries = Get16u(DirWithThumbnailPtrs);

 for (de=0;de<NumDirEntries;de++){
 int Tag;
 unsigned char * DirEntry;
 DirEntry = DIR_ENTRY_ADDR(DirWithThumbnailPtrs, de);
 Tag = Get16u(DirEntry);
 if (Tag == TAG_THUMBNAIL_LENGTH){
 if (Get16u(DirEntry+2) != FMT_ULONG){
 ErrNonfatal("Can't remove thumbnail", 0, 0);
 return 0;
 }
 Put32u(DirEntry+8, 0);
 }
 }
 }

 return ImageInfo.ThumbnailOffset+8;

}
Commit message: None
CVE: CVE-2016-3819
CWE: CWE-119
Vulnerability description: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562.

Project: Android

static u32 Mmcop6(dpbStorage_t *dpb, u32 frameNum, i32 picOrderCnt,
    u32 longTermFrameIdx)
{

/* Variables */

    u32 i;

/* Code */

    ASSERT(frameNum < dpb->maxFrameNum);

 if ( (dpb->maxLongTermFrameIdx == NO_LONG_TERM_FRAME_INDICES) ||
 (longTermFrameIdx > dpb->maxLongTermFrameIdx) )
 return(HANTRO_NOK);

 /* check if a long term picture with the same longTermFrameIdx already
     * exist and remove it if necessary */
 for (i = 0; i < dpb->maxRefFrames; i++)
 if (IS_LONG_TERM(dpb->buffer[i]) &&
 (u32)dpb->buffer[i].picNum == longTermFrameIdx)
 {
            SET_UNUSED(dpb->buffer[i]);
            dpb->numRefFrames--;
 if (!dpb->buffer[i].toBeDisplayed)
                dpb->fullness--;
 break;
 }

 if (dpb->numRefFrames < dpb->maxRefFrames)
 {
        dpb->currentOut->frameNum = frameNum;
        dpb->currentOut->picNum   = (i32)longTermFrameIdx;
        dpb->currentOut->picOrderCnt = picOrderCnt;
        dpb->currentOut->status   = LONG_TERM;
 if (dpb->noReordering)
            dpb->currentOut->toBeDisplayed = HANTRO_FALSE;
 else
            dpb->currentOut->toBeDisplayed = HANTRO_TRUE;
        dpb->numRefFrames++;
        dpb->fullness++;
 return(HANTRO_OK);
 }
 /* if there is no room, return an error */
 else
 return(HANTRO_NOK);

}

Project: Android

u32 OutputPicture(dpbStorage_t *dpb)
{

/* Variables */

 dpbPicture_t *tmp;

/* Code */

    ASSERT(dpb);

 if (dpb->noReordering)
 return(HANTRO_NOK);

    tmp = FindSmallestPicOrderCnt(dpb);

 /* no pictures to be displayed */
 if (tmp == NULL)
 return(HANTRO_NOK);

    dpb->outBuf[dpb->numOut].data  = tmp->data;
    dpb->outBuf[dpb->numOut].isIdr = tmp->isIdr;
    dpb->outBuf[dpb->numOut].picId = tmp->picId;
    dpb->outBuf[dpb->numOut].numErrMbs = tmp->numErrMbs;
    dpb->numOut++;

    tmp->toBeDisplayed = HANTRO_FALSE;
 if (!IS_REFERENCE(*tmp))
 {
        dpb->fullness--;
 }

 return(HANTRO_OK);

}

Project: Android

dpbOutPicture_t* h264bsdDpbOutputPicture(dpbStorage_t *dpb)
{

/* Variables */

/* Code */

    ASSERT(dpb);

 if (dpb->outIndex < dpb->numOut)
 return(dpb->outBuf + dpb->outIndex++);
 else
 return(NULL);

}

Project: Android

void h264bsdFreeDpb(dpbStorage_t *dpb)
{

/* Variables */

    u32 i;

/* Code */

    ASSERT(dpb);

 if (dpb->buffer)
 {
 for (i = 0; i < dpb->dpbSize+1; i++)
 {
            FREE(dpb->buffer[i].pAllocatedData);
 }
 }
    FREE(dpb->buffer);
    FREE(dpb->list);
    FREE(dpb->outBuf);

}
Commit message: None
CVE: CVE-2016-3765
CWE: CWE-200
Vulnerability description: decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application, aka internal bug 28168413.

Project: Android

INLINE UWORD32 impeg2d_bit_stream_nxt( stream_t *ps_stream, WORD32 i4_no_of_bits)
{
    UWORD32     u4_bits,u4_offset,u4_temp;
    UWORD8      u4_bit_ptr;

    ASSERT(i4_no_of_bits > 0);

    u4_offset               = ps_stream->u4_offset;
    u4_bit_ptr              = u4_offset & 0x1F;
    u4_bits                 = ps_stream->u4_buf << u4_bit_ptr;

    u4_bit_ptr              += i4_no_of_bits;
 if(32 < u4_bit_ptr)
 {
 /*  Read bits from the next word if necessary */
        u4_temp             = ps_stream->u4_buf_nxt;
        u4_bit_ptr          &= (BITS_IN_INT - 1);

        u4_temp             = (u4_temp >> (BITS_IN_INT - u4_bit_ptr));

 /* u4_temp consists of bits,if any that had to be read from the next word
           of the buffer.The bits read from both the words are concatenated and
           moved to the least significant positions of 'u4_bits'*/
        u4_bits = (u4_bits >> (32 - i4_no_of_bits)) | u4_temp;
 }
 else
 {
        u4_bits = (u4_bits >> (32 - i4_no_of_bits));
 }

 return (u4_bits);
}
Commit message: None
CVE: CVE-2016-3758
CWE: CWE-119
Vulnerability description: Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.

Project: Android

static int dexOptMkdir(const char*  path, int mode)
{
#ifdef _WIN32
 return mkdir(path);
#else
 return mkdir(path, mode);
#endif
}
Commit message: None
CVE: CVE-2016-3757
CWE: CWE-20
Vulnerability description: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.

Project: Android

int lsof_main(int argc, char *argv[])
{
 long int pid = 0;
 char* endptr;
 if (argc == 2) {
        pid = strtol(argv[1], &endptr, 10);
 }

    print_header();

 if (pid) {
        lsof_dumpinfo(pid);
 } else {
 DIR *dir = opendir("/proc");
 if (dir == NULL) {
            fprintf(stderr, "Couldn't open /proc\n");
 return -1;
 }

 struct dirent* de;
 while ((de = readdir(dir))) {
 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
 continue;

            pid = strtol(de->d_name, &endptr, 10);
 if (*endptr != '\0')
 continue;

            lsof_dumpinfo(pid);
 }
        closedir(dir);
 }

 return 0;
}

Project: Android

static void print_fds(struct pid_info_t* info)
{
 static char* fd_path = "fd/";
    strlcat(info->path, fd_path, sizeof(info->path));

 int previous_length = info->parent_length;
    info->parent_length += strlen(fd_path);

 DIR *dir = opendir(info->path);
 if (dir == NULL) {
 char msg[BUF_MAX];
        snprintf(msg, sizeof(msg), "%s (opendir: %s)", info->path, strerror(errno));
        printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n",
                info->cmdline, info->pid, info->user, "FDS",
 "", "", "", "", msg);
 goto out;
 }

 struct dirent* de;
 while ((de = readdir(dir))) {
 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
 continue;

        print_type(de->d_name, info);
 }
    closedir(dir);

out:
    info->parent_length = previous_length;
    info->path[info->parent_length] = '\0';
}
Commit message: None
CVE: CVE-2016-2507
CWE: CWE-119
Vulnerability description: Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28532266.

Project: Android

void h264bsdComputeSliceGroupMap(storage_t *pStorage, u32 sliceGroupChangeCycle)
{

/* Variables */


/* Code */

    h264bsdDecodeSliceGroupMap(pStorage->sliceGroupMap,
                        pStorage->activePps, sliceGroupChangeCycle,
                        pStorage->activeSps->picWidthInMbs,
                        pStorage->activeSps->picHeightInMbs);

}
Commit message: None
CVE: CVE-2016-2506
CWE: CWE-119
Vulnerability description: DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate a certain offset value, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28175045.

Project: Android

sp<MetaData> DRMExtractor::getTrackMetaData(size_t index, uint32_t flags) {
 return mOriginalExtractor->getTrackMetaData(index, flags);
}