db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2018-16086
CWE: CWE-285
Vulnerability description: Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

Project: Chrome

testing::AssertionResult CheckStyleInjection(Browser* browser,
                                             const GURL& url,
                                             bool expected_injection) {
  ui_test_utils::NavigateToURL(browser, url);

  bool css_injected = false;
  if (!content::ExecuteScriptAndExtractBool(
          browser->tab_strip_model()->GetActiveWebContents(),
          "window.domAutomationController.send("
          "    document.defaultView.getComputedStyle(document.body, null)."
          "        getPropertyValue('display') == 'none');",
          &css_injected)) {
    return testing::AssertionFailure()
        << "Failed to execute script and extract bool for injection status.";
  }

  if (css_injected != expected_injection) {
    std::string message;
    if (css_injected)
      message = "CSS injected when no injection was expected.";
    else
      message = "CSS not injected when injection was expected.";
    return testing::AssertionFailure() << message;
  }

  bool css_doesnt_add_to_list = false;
  if (!content::ExecuteScriptAndExtractBool(
          browser->tab_strip_model()->GetActiveWebContents(),
          "window.domAutomationController.send("
          "    document.styleSheets.length == 0);",
          &css_doesnt_add_to_list)) {
    return testing::AssertionFailure()
        << "Failed to execute script and extract bool for stylesheets length.";
  }
  if (!css_doesnt_add_to_list) {
    return testing::AssertionFailure()
        << "CSS injection added to number of stylesheets.";
  }

  return testing::AssertionSuccess();
}

Project: Chrome

  ContentScriptApiTest() {}

Project: Chrome

bool RunAllPending(content::WebContents* web_contents) {
  if (!content::ExecuteScript(web_contents, "1 == 1;"))
    return false;
  base::RunLoop().RunUntilIdle();
  return true;
}

Project: Chrome

RendererPermissionsPolicyDelegate::~RendererPermissionsPolicyDelegate() {
  PermissionsData::SetPolicyDelegate(NULL);
}
Commit message: None
CVE: CVE-2018-6137
CWE: CWE-200
Vulnerability description: CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Project: Chrome

CSSPaintValue::CSSPaintValue(CSSCustomIdentValue* name)
    : CSSImageGeneratorValue(kPaintClass),
      name_(name),
      paint_image_generator_observer_(new Observer(this)) {}

Project: Chrome

CSSPaintValue::CSSPaintValue(
    CSSCustomIdentValue* name,
    Vector<scoped_refptr<CSSVariableData>>& variable_data)
    : CSSPaintValue(name) {
  argument_variable_data_.swap(variable_data);
}

Project: Chrome

String CSSPaintValue::CustomCSSText() const {
  StringBuilder result;
  result.Append("paint(");
  result.Append(name_->CustomCSSText());
  for (const auto& variable_data : argument_variable_data_) {
    result.Append(", ");
    result.Append(variable_data.get()->TokenRange().Serialize());
  }
  result.Append(')');
  return result.ToString();
}

Project: Chrome

bool CSSPaintValue::Equals(const CSSPaintValue& other) const {
  return GetName() == other.GetName() &&
         CustomCSSText() == other.CustomCSSText();
}

Project: Chrome

String CSSPaintValue::GetName() const {
  return name_->Value();
}

Project: Chrome

void CSSPaintValue::Observer::PaintImageGeneratorReady() {
  owner_value_->PaintImageGeneratorReady();
}

Project: Chrome

void CSSPaintValue::PaintImageGeneratorReady() {
  for (const ImageResourceObserver* client : Clients().Keys()) {
    const_cast<ImageResourceObserver*>(client)->ImageChanged(
        static_cast<WrappedImagePtr>(this),
        ImageResourceObserver::CanDeferInvalidation::kNo);
  }
}

Project: Chrome

void CSSPaintValue::TraceAfterDispatch(blink::Visitor* visitor) {
  visitor->Trace(name_);
  visitor->Trace(generator_);
  visitor->Trace(paint_image_generator_observer_);
  visitor->Trace(parsed_input_arguments_);
  CSSImageGeneratorValue::TraceAfterDispatch(visitor);
}
Commit message: None
CVE: CVE-2015-3831
CWE: CWE-119
Vulnerability description: Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.

Project: Android

 virtual bool connect(
 const char *uri, const KeyedVector<String8, String8> *headers) {
 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

 String16 tmp(uri);
        data.writeString16(tmp);

        tmp = String16("");
 if (headers != NULL) {
 for (size_t i = 0; i < headers->size(); ++i) {
 String16 key(headers->keyAt(i).string());
 String16 val(headers->valueAt(i).string());

                tmp.append(key);
                tmp.append(String16(": "));
                tmp.append(val);
                tmp.append(String16("\r\n"));
 }
 }
        data.writeString16(tmp);

        remote()->transact(CONNECT, data, &reply);

 int32_t exceptionCode = reply.readExceptionCode();

 if (exceptionCode) {
 return UNKNOWN_ERROR;
 }

        sp<IBinder> binder = reply.readStrongBinder();
        mMemory = interface_cast<IMemory>(binder);

 return mMemory != NULL;
 }

Project: Android

 virtual status_t getMIMEType(String8 *mimeType) {
 *mimeType = String8("");

 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

        remote()->transact(GET_MIME_TYPE, data, &reply);

 int32_t exceptionCode = reply.readExceptionCode();

 if (exceptionCode) {
 return UNKNOWN_ERROR;
 }

 *mimeType = String8(reply.readString16());

 return OK;
 }

Project: Android

 virtual off64_t getSize() {
 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

        remote()->transact(GET_SIZE, data, &reply);

 int32_t exceptionCode = reply.readExceptionCode();

 if (exceptionCode) {
 return UNKNOWN_ERROR;
 }

 return reply.readInt64();
 }

Project: Android

 virtual status_t getUri(String8 *uri) {
 *uri = String8("");

 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

        remote()->transact(GET_URI, data, &reply);

 int32_t exceptionCode = reply.readExceptionCode();

 if (exceptionCode) {
 return UNKNOWN_ERROR;
 }

 *uri = String8(reply.readString16());

 return OK;
 }
Commit message: None
CVE: CVE-2015-1539
CWE: CWE-189
Vulnerability description: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.

Project: Android

ESDS::ESDS(const void *data, size_t size)
 : mData(new uint8_t[size]),
      mSize(size),
      mInitCheck(NO_INIT),
      mDecoderSpecificOffset(0),
      mDecoderSpecificLength(0),
      mObjectTypeIndication(0) {
    memcpy(mData, data, size);

    mInitCheck = parse();
}

Project: Android

status_t ESDS::InitCheck() const {
 return mInitCheck;
}

Project: Android

status_t ESDS::getCodecSpecificInfo(const void **data, size_t *size) const {
 if (mInitCheck != OK) {
 return mInitCheck;
 }

 *data = &mData[mDecoderSpecificOffset];
 *size = mDecoderSpecificLength;

 return OK;
}

Project: Android

status_t ESDS::getObjectTypeIndication(uint8_t *objectTypeIndication) const {
 if (mInitCheck != OK) {
 return mInitCheck;
 }

 *objectTypeIndication = mObjectTypeIndication;

 return OK;
}

Project: Android

status_t ESDS::parse() {
 uint8_t tag;
 size_t data_offset;
 size_t data_size;
 status_t err =
        skipDescriptorHeader(0, mSize, &tag, &data_offset, &data_size);

 if (err != OK) {
 return err;
 }

 if (tag != kTag_ESDescriptor) {
 return ERROR_MALFORMED;
 }

 return parseESDescriptor(data_offset, data_size);
}

Project: Android

status_t ESDS::parseDecoderConfigDescriptor(size_t offset, size_t size) {
 if (size < 13) {
 return ERROR_MALFORMED;
 }

    mObjectTypeIndication = mData[offset];

    offset += 13;
    size -= 13;

 if (size == 0) {
        mDecoderSpecificOffset = 0;
        mDecoderSpecificLength = 0;
 return OK;
 }

 uint8_t tag;
 size_t sub_offset, sub_size;
 status_t err = skipDescriptorHeader(
            offset, size, &tag, &sub_offset, &sub_size);

 if (err != OK) {
 return err;
 }

 if (tag != kTag_DecoderSpecificInfo) {
 return ERROR_MALFORMED;
 }

    mDecoderSpecificOffset = sub_offset;
    mDecoderSpecificLength = sub_size;

 return OK;
}

Project: Android

status_t ESDS::skipDescriptorHeader(
 size_t offset, size_t size,
 uint8_t *tag, size_t *data_offset, size_t *data_size) const {
 if (size == 0) {
 return ERROR_MALFORMED;
 }

 *tag = mData[offset++];
 --size;

 *data_size = 0;
 bool more;
 do {
 if (size == 0) {
 return ERROR_MALFORMED;
 }

 uint8_t x = mData[offset++];
 --size;

 *data_size = (*data_size << 7) | (x & 0x7f);
        more = (x & 0x80) != 0;
 }
 while (more);

    ALOGV("tag=0x%02x data_size=%zu", *tag, *data_size);

 if (*data_size > size) {
 return ERROR_MALFORMED;
 }

 *data_offset = offset;

 return OK;
}

Project: Android

ESDS::~ESDS() {
 delete[] mData;
    mData = NULL;
}
Commit message: None
CVE: CVE-2016-3765
CWE: CWE-200
Vulnerability description: decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application, aka internal bug 28168413.

Project: Android

INLINE void impeg2d_bit_stream_flush_to_byte_boundary(void* pv_ctxt)
{
    UWORD8 u1_bit_offset;
 stream_t *ps_stream = (stream_t *)pv_ctxt;

    u1_bit_offset = (ps_stream->u4_offset) & 0x7;


 /* if it is not byte aligned make it byte aligned*/
 if(u1_bit_offset != 0)
 {
        impeg2d_bit_stream_flush(ps_stream,(8 - u1_bit_offset));
 }



}

Project: Android

INLINE UWORD32 impeg2d_bit_stream_get(void* pv_ctxt, UWORD32 u4_num_bits)
{
    UWORD32 u4_next_bits = impeg2d_bit_stream_nxt(pv_ctxt, u4_num_bits);
    impeg2d_bit_stream_flush(pv_ctxt, u4_num_bits);
 return(u4_next_bits);
}

Project: Android

void impeg2d_bit_stream_init(stream_t *ps_stream,
                             UWORD8 *pu1_byte_buf,
                             UWORD32 u4_max_offset)
{
    UWORD8      *pu1_byte_buff;
    UWORD32     *pu4_word_buf;
 size_t     u4_byte_addr;
    UWORD32     u4_temp1,u4_temp2;

 /* Set parameters of the stream structure.Associate the structure with
       the file */
    ps_stream->pv_bs_buf           = pu1_byte_buf;
    ps_stream->u4_offset              = 0;

 /* Take care of unaligned address and create
       nearest greater aligned address */
    pu1_byte_buff               = (UWORD8 *)pu1_byte_buf;
    u4_byte_addr                = (size_t)pu1_byte_buff;

 if((u4_byte_addr & 3) == 1)
 {
        u4_temp1                = ((UWORD32)(*pu1_byte_buff++)) << 8;
        u4_temp1                += ((UWORD32)(*pu1_byte_buff++)) << 16;
        u4_temp1                += ((UWORD32)(*pu1_byte_buff++)) << 24;

        pu4_word_buf            = (UWORD32 *)pu1_byte_buff;

        ps_stream->u4_offset          = 8;
 }
 else if((u4_byte_addr & 3) == 2)
 {
        u4_temp1                = ((UWORD32)(*pu1_byte_buff++)) << 16;
        u4_temp1                += ((UWORD32)(*pu1_byte_buff++)) << 24;

        pu4_word_buf            = (UWORD32 *)pu1_byte_buff;

        ps_stream->u4_offset          = 16;
 }
 else if((u4_byte_addr & 3) == 3)
 {
        u4_temp1                = (((UWORD32)(*pu1_byte_buff++)) << 24);

        pu4_word_buf            = (UWORD32 *)pu1_byte_buff;

        ps_stream->u4_offset          = 24;
 }
 else
 {
        pu4_word_buf            = (UWORD32 *)pu1_byte_buff;

        u4_temp1                = *pu4_word_buf++;
        ps_stream->u4_offset          = 0;
 }

 /* convert the endian ness from Little endian to Big endian so that bits
       are in proper order from MSB to LSB */
    CONV_LE_TO_BE(u4_temp2,u4_temp1)

 /* Read One more word for buf nxt */
    u4_temp1                    = *pu4_word_buf++;
    ps_stream->u4_buf              = u4_temp2;

    CONV_LE_TO_BE(u4_temp2,u4_temp1)

    ps_stream->u4_buf_nxt          = u4_temp2;

    ps_stream->pu4_buf_aligned      = pu4_word_buf;


    ps_stream->u4_max_offset        = (u4_max_offset << 3) + ps_stream->u4_offset;

 return;
}
Commit message: None
CVE: CVE-2016-3758
CWE: CWE-119
Vulnerability description: Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.

Project: Android

int dexOptCreateEmptyHeader(int fd)
{
 DexOptHeader optHdr;
 ssize_t actual;

    assert(lseek(fd, 0, SEEK_CUR) == 0);

 /*
     * The data is only expected to be readable on the current system, so
     * we just write the structure.  We do need the file offset to be 64-bit
     * aligned to fulfill a DEX requirement.
     */
    assert((sizeof(optHdr) & 0x07) == 0);
    memset(&optHdr, 0xff, sizeof(optHdr));
    optHdr.dexOffset = sizeof(optHdr);
    actual = write(fd, &optHdr, sizeof(optHdr));
 if (actual != sizeof(optHdr)) {
 int err = errno ? errno : -1;
        ALOGE("opt header write failed: %s", strerror(errno));
 return errno;
 }

 return 0;
}
Commit message: None
CVE: CVE-2016-3757
CWE: CWE-20
Vulnerability description: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.

Project: Android

static void lsof_dumpinfo(pid_t pid)
{
 int fd;
 struct pid_info_t info;
 struct stat pidstat;
 struct passwd *pw;

    info.pid = pid;
    snprintf(info.path, sizeof(info.path), "/proc/%d/", pid);
    info.parent_length = strlen(info.path);

 if (!stat(info.path, &pidstat)) {
        pw = getpwuid(pidstat.st_uid);
 if (pw) {
            strlcpy(info.user, pw->pw_name, sizeof(info.user));
 } else {
            snprintf(info.user, USER_DISPLAY_MAX, "%d", (int)pidstat.st_uid);
 }
 } else {
        strcpy(info.user, "???");
 }

    strlcat(info.path, "cmdline", sizeof(info.path));
    fd = open(info.path, O_RDONLY);
 if (fd < 0) {
        fprintf(stderr, "Couldn't read %s\n", info.path);
 return;
 }

 char cmdline[PATH_MAX];
 int numRead = read(fd, cmdline, sizeof(cmdline) - 1);
    close(fd);

 if (numRead < 0) {
        fprintf(stderr, "Error reading cmdline: %s: %s\n", info.path, strerror(errno));
 return;
 }

    cmdline[numRead] = '\0';

    strlcpy(info.cmdline, basename(cmdline), sizeof(info.cmdline));

    print_type("cwd", &info);
    print_type("exe", &info);
    print_type("root", &info);

    print_fds(&info);
    print_maps(&info);
}

Project: Android

static void print_header()
{
    printf("%-9s %5s %10s %4s %9s %18s %9s %10s %s\n",
 "COMMAND",
 "PID",
 "USER",
 "FD",
 "TYPE",
 "DEVICE",
 "SIZE/OFF",
 "NODE",
 "NAME");
}

Project: Android

static void print_type(char *type, struct pid_info_t* info)
{
 static ssize_t link_dest_size;
 static char link_dest[PATH_MAX];

    strlcat(info->path, type, sizeof(info->path));
 if ((link_dest_size = readlink(info->path, link_dest, sizeof(link_dest)-1)) < 0) {
 if (errno == ENOENT)
 goto out;

        snprintf(link_dest, sizeof(link_dest), "%s (readlink: %s)", info->path, strerror(errno));
 } else {
        link_dest[link_dest_size] = '\0';
 }

 if (!strcmp(link_dest, "/"))
 goto out;

    printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n",
            info->cmdline, info->pid, info->user, type,
 "???", "???", "???", "???", link_dest);

out:
    info->path[info->parent_length] = '\0';
}
Commit message: None
CVE: CVE-2016-3756
CWE: CWE-20
Vulnerability description: Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28556125.

Project: Android

void res_clear_info(vorbis_info_residue *info){
 if(info){
 if(info->stagemasks)_ogg_free(info->stagemasks);
 if(info->stagebooks)_ogg_free(info->stagebooks);
    memset(info,0,sizeof(*info));
 }
}
Commit message: None
CVE: CVE-2016-2448
CWE: CWE-264
Vulnerability description: media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.

Project: Android

NuPlayer::NuPlayerStreamListener::NuPlayerStreamListener(
 const sp<IStreamSource> &source,
 const sp<AHandler> &targetHandler)
 : mSource(source),
      mTargetHandler(targetHandler),
      mEOS(false),
      mSendDataNotification(true) {
    mSource->setListener(this);

    mMemoryDealer = new MemoryDealer(kNumBuffers * kBufferSize);
 for (size_t i = 0; i < kNumBuffers; ++i) {
        sp<IMemory> mem = mMemoryDealer->allocate(kBufferSize);
        CHECK(mem != NULL);

        mBuffers.push(mem);
 }
    mSource->setBuffers(mBuffers);
}

Project: Android

void NuPlayer::NuPlayerStreamListener::issueCommand(
 Command cmd, bool synchronous, const sp<AMessage> &extra) {
    CHECK(!synchronous);

 QueueEntry entry;
    entry.mIsCommand = true;
    entry.mCommand = cmd;
    entry.mExtra = extra;

 Mutex::Autolock autoLock(mLock);
    mQueue.push_back(entry);

 if (mSendDataNotification) {
        mSendDataNotification = false;

 if (mTargetHandler != NULL) {
 (new AMessage(kWhatMoreDataQueued, mTargetHandler))->post();
 }
 }
}

Project: Android

void NuPlayer::NuPlayerStreamListener::queueBuffer(size_t index, size_t size) {
 QueueEntry entry;
    entry.mIsCommand = false;
    entry.mIndex = index;
    entry.mSize = size;
    entry.mOffset = 0;

 Mutex::Autolock autoLock(mLock);
    mQueue.push_back(entry);

 if (mSendDataNotification) {
        mSendDataNotification = false;

 if (mTargetHandler != NULL) {
 (new AMessage(kWhatMoreDataQueued, mTargetHandler))->post();
 }
 }
}

Project: Android

void NuPlayer::NuPlayerStreamListener::start() {
 for (size_t i = 0; i < kNumBuffers; ++i) {
        mSource->onBufferAvailable(i);
 }
}
Commit message: None
CVE: CVE-2016-2430
CWE: CWE-264
Vulnerability description: libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236.

Project: Android

Backtrace::Backtrace(pid_t pid, pid_t tid, BacktraceMap* map)
 : pid_(pid), tid_(tid), map_(map), map_shared_(true) {
 if (map_ == nullptr) {
    map_ = BacktraceMap::Create(pid);
    map_shared_ = false;
 }
}

Project: Android

Backtrace* Backtrace::Create(pid_t pid, pid_t tid, BacktraceMap* map) {
 if (pid == BACKTRACE_CURRENT_PROCESS) {
    pid = getpid();
 if (tid == BACKTRACE_CURRENT_THREAD) {
      tid = gettid();
 }
 } else if (tid == BACKTRACE_CURRENT_THREAD) {
    tid = pid;
 }

 if (pid == getpid()) {
 return new UnwindCurrent(pid, tid, map);
 } else {
 return new UnwindPtrace(pid, tid, map);
 }
}

Project: Android

void Backtrace::FillInMap(uintptr_t pc, backtrace_map_t* map) {
 if (map_ != nullptr) {
    map_->FillIn(pc, map);
 }
}

Project: Android

std::string Backtrace::FormatFrameData(size_t frame_num) {
 if (frame_num >= frames_.size()) {
 return "";
 }
 return FormatFrameData(&frames_[frame_num]);
}

Project: Android

std::string Backtrace::FormatFrameData(const backtrace_frame_data_t* frame) {
 const char* map_name;
 if (BacktraceMap::IsValid(frame->map) && !frame->map.name.empty()) {
    map_name = frame->map.name.c_str();
 } else {
    map_name = "<unknown>";
 }

 uintptr_t relative_pc = BacktraceMap::GetRelativePc(frame->map, frame->pc);

  std::string line(StringPrintf("#%02zu pc %" PRIPTR "  %s", frame->num, relative_pc, map_name));
 if (frame->map.offset != 0) {
    line += " (offset " + StringPrintf("0x%" PRIxPTR, frame->map.offset) + ")";
 }
 if (!frame->func_name.empty()) {
    line += " (" + frame->func_name;
 if (frame->func_offset) {
      line += StringPrintf("+%" PRIuPTR, frame->func_offset);
 }
    line += ')';
 }

 return line;
}

Project: Android

bool Backtrace::VerifyReadWordArgs(uintptr_t ptr, word_t* out_value) {
 if (ptr & (sizeof(word_t)-1)) {
    BACK_LOGW("invalid pointer %p", reinterpret_cast<void*>(ptr));
 *out_value = static_cast<word_t>(-1);
 return false;
 }
 return true;
}

Project: Android

Backtrace::~Backtrace() {
 if (map_ && !map_shared_) {
 delete map_;
    map_ = nullptr;

   }
 }
Commit message: None
CVE: CVE-2016-1621
CWE: CWE-119
Vulnerability description: libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.

Project: Android

SoftVPX::SoftVPX(
 const char *name,
 const char *componentRole,
        OMX_VIDEO_CODINGTYPE codingType,
 const OMX_CALLBACKTYPE *callbacks,
        OMX_PTR appData,
        OMX_COMPONENTTYPE **component)
 : SoftVideoDecoderOMXComponent(
            name, componentRole, codingType,
            NULL /* profileLevels */, 0 /* numProfileLevels */,
 320 /* width */, 240 /* height */, callbacks, appData, component),
      mMode(codingType == OMX_VIDEO_CodingVP8 ? MODE_VP8 : MODE_VP9),
      mCtx(NULL),
      mImg(NULL) {
 const size_t kMinCompressionRatio = mMode == MODE_VP8 ? 2 : 4;
 const char *mime = mMode == MODE_VP8 ? MEDIA_MIMETYPE_VIDEO_VP8 : MEDIA_MIMETYPE_VIDEO_VP9;
 const size_t kMaxOutputBufferSize = 2048 * 2048 * 3 / 2;
    initPorts(
            kNumBuffers, kMaxOutputBufferSize / kMinCompressionRatio /* inputBufferSize */,
            kNumBuffers, mime, kMinCompressionRatio);
    CHECK_EQ(initDecoder(), (status_t)OK);
}

Project: Android

status_t SoftVPX::initDecoder() {
    mCtx = new vpx_codec_ctx_t;
 vpx_codec_err_t vpx_err;
 vpx_codec_dec_cfg_t cfg;
    memset(&cfg, 0, sizeof(vpx_codec_dec_cfg_t));
    cfg.threads = GetCPUCoreCount();
 if ((vpx_err = vpx_codec_dec_init(
 (vpx_codec_ctx_t *)mCtx,
                 mMode == MODE_VP8 ? &vpx_codec_vp8_dx_algo : &vpx_codec_vp9_dx_algo,
 &cfg, 0))) {
        ALOGE("on2 decoder failed to initialize. (%d)", vpx_err);
 return UNKNOWN_ERROR;
 }

 return OK;
}

Project: Android

SoftVPX::~SoftVPX() {
    vpx_codec_destroy((vpx_codec_ctx_t *)mCtx);
 delete (vpx_codec_ctx_t *)mCtx;
    mCtx = NULL;
}
Commit message: None
CVE: CVE-2016-0807
CWE: CWE-264
Vulnerability description: The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.

Project: Android

bool elf_get_build_id(Backtrace* backtrace, uintptr_t addr, std::string* build_id) {
 uint8_t e_ident[EI_NIDENT];
 if (backtrace->Read(addr, e_ident, SELFMAG) != SELFMAG) {
 return false;
 }

 if (memcmp(e_ident, ELFMAG, SELFMAG) != 0) {
 return false;
 }

 if (backtrace->Read(addr + SELFMAG, e_ident + SELFMAG, EI_NIDENT - SELFMAG) != EI_NIDENT - SELFMAG) {
 return false;
 }

 if (e_ident[EI_CLASS] == ELFCLASS32) {
 return get_build_id<Elf32_Ehdr, Elf32_Phdr, Elf32_Nhdr>(backtrace, addr, e_ident, build_id);
 } else if (e_ident[EI_CLASS] == ELFCLASS64) {
 return get_build_id<Elf64_Ehdr, Elf64_Phdr, Elf64_Nhdr>(backtrace, addr, e_ident, build_id);
 }

 return false;
}