db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2015-1536
CWE: CWE-189
Vulnerability description: Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.

Project: Android

static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
 if (parcel == NULL) {
 SkDebugf("-------- unparcel parcel is NULL\n");
 return NULL;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 const bool        isMutable = p->readInt32() != 0;
 const SkColorType colorType = (SkColorType)p->readInt32();
 const SkAlphaType alphaType = (SkAlphaType)p->readInt32();
 const int         width = p->readInt32();
 const int         height = p->readInt32();
 const int         rowBytes = p->readInt32();
 const int         density = p->readInt32();

 if (kN32_SkColorType != colorType &&
            kRGB_565_SkColorType != colorType &&
            kARGB_4444_SkColorType != colorType &&
            kIndex_8_SkColorType != colorType &&
            kAlpha_8_SkColorType != colorType) {
 SkDebugf("Bitmap_createFromParcel unknown colortype: %d\n", colorType);

         return NULL;
     }
 
    SkBitmap* bitmap = new SkBitmap;
 
    bitmap->setInfo(SkImageInfo::Make(width, height, colorType, alphaType), rowBytes);
 
     SkColorTable* ctable = NULL;
     if (colorType == kIndex_8_SkColorType) {
         int count = p->readInt32();
         if (count > 0) {
             size_t size = count * sizeof(SkPMColor);
             const SkPMColor* src = (const SkPMColor*)p->readInplace(size);
             ctable = new SkColorTable(src, count);
         }
     }
 
    jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable);
     if (NULL == buffer) {
         SkSafeUnref(ctable);
        delete bitmap;
         return NULL;
     }
 
 SkSafeUnref(ctable);

 size_t size = bitmap->getSize();

    android::Parcel::ReadableBlob blob;

     android::status_t status = p->readBlob(size, &blob);
     if (status) {
         doThrowRE(env, "Could not read bitmap from parcel blob.");
        delete bitmap;
         return NULL;
     }
 
    bitmap->lockPixels();
    memcpy(bitmap->getPixels(), blob.data(), size);
    bitmap->unlockPixels();

 
     blob.release();
 
    return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable),
            NULL, NULL, density);
 }
Commit message: None
CVE: CVE-2015-1528
CWE: CWE-189
Vulnerability description: Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.

Project: Android

native_handle* Parcel::readNativeHandle() const
{
 int numFds, numInts;
 status_t err;
    err = readInt32(&numFds);
 if (err != NO_ERROR) return 0;
    err = readInt32(&numInts);

     if (err != NO_ERROR) return 0;
 
     native_handle* h = native_handle_create(numFds, numInts);
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
         if (h->data[i] < 0) err = BAD_VALUE;
 }
    err = read(h->data + numFds, sizeof(int)*numInts);
 if (err != NO_ERROR) {
        native_handle_close(h);
        native_handle_delete(h);
        h = 0;
 }
 return h;
}
Commit message: None
CVE: CVE-2016-6722
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-31091777.

Project: Android

status_t SampleIterator::seekTo(uint32_t sampleIndex) {
    ALOGV("seekTo(%d)", sampleIndex);

 if (sampleIndex >= mTable->mNumSampleSizes) {
 return ERROR_END_OF_STREAM;
 }

 if (mTable->mSampleToChunkOffset < 0
 || mTable->mChunkOffsetOffset < 0
 || mTable->mSampleSizeOffset < 0
 || mTable->mTimeToSampleCount == 0) {

 return ERROR_MALFORMED;
 }

 if (mInitialized && mCurrentSampleIndex == sampleIndex) {
 return OK;
 }

 if (!mInitialized || sampleIndex < mFirstChunkSampleIndex) {
        reset();
 }

 if (sampleIndex >= mStopChunkSampleIndex) {
 status_t err;
 if ((err = findChunkRange(sampleIndex)) != OK) {
            ALOGE("findChunkRange failed");
 return err;
 }
 }

    CHECK(sampleIndex < mStopChunkSampleIndex);

 if (mSamplesPerChunk == 0) {
        ALOGE("b/22802344");
 return ERROR_MALFORMED;
 }

 uint32_t chunk =
 (sampleIndex - mFirstChunkSampleIndex) / mSamplesPerChunk

         + mFirstChunk;
 
     if (!mInitialized || chunk != mCurrentChunkIndex) {
        mCurrentChunkIndex = chunk;
         status_t err;
         if ((err = getChunkOffset(chunk, &mCurrentChunkOffset)) != OK) {
             ALOGE("getChunkOffset return error");
 return err;
 }

        mCurrentChunkSampleSizes.clear();

 
         uint32_t firstChunkSampleIndex =
             mFirstChunkSampleIndex
                + mSamplesPerChunk * (mCurrentChunkIndex - mFirstChunk);
 
         for (uint32_t i = 0; i < mSamplesPerChunk; ++i) {
             size_t sampleSize;
             if ((err = getSampleSizeDirect(
                             firstChunkSampleIndex + i, &sampleSize)) != OK) {
                 ALOGE("getSampleSizeDirect return error");
                 return err;
             }
 
             mCurrentChunkSampleSizes.push(sampleSize);
         }
     }
 
     uint32_t chunkRelativeSampleIndex =
 (sampleIndex - mFirstChunkSampleIndex) % mSamplesPerChunk;

    mCurrentSampleOffset = mCurrentChunkOffset;
 for (uint32_t i = 0; i < chunkRelativeSampleIndex; ++i) {
        mCurrentSampleOffset += mCurrentChunkSampleSizes[i];
 }

    mCurrentSampleSize = mCurrentChunkSampleSizes[chunkRelativeSampleIndex];
 if (sampleIndex < mTTSSampleIndex) {
        mTimeToSampleIndex = 0;
        mTTSSampleIndex = 0;
        mTTSSampleTime = 0;
        mTTSCount = 0;
        mTTSDuration = 0;
 }

 status_t err;
 if ((err = findSampleTimeAndDuration(
            sampleIndex, &mCurrentSampleTime, &mCurrentSampleDuration)) != OK) {
        ALOGE("findSampleTime return error");
 return err;
 }

    mCurrentSampleIndex = sampleIndex;

    mInitialized = true;

 return OK;
}
Commit message: None
CVE: CVE-2016-6712
CWE: CWE-20
Vulnerability description: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.

Project: Android

int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
 int new_mi_size;

  vp9_set_mb_mi(cm, width, height);
  new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows);
 if (cm->mi_alloc_size < new_mi_size) {
    cm->free_mi(cm);
 if (cm->alloc_mi(cm, new_mi_size))
 goto fail;
 }

 if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
    free_seg_map(cm);
 if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols))
 goto fail;
 }

 if (cm->above_context_alloc_cols < cm->mi_cols) {
    vpx_free(cm->above_context);
    cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc(
 2 * mi_cols_aligned_to_sb(cm->mi_cols) * MAX_MB_PLANE,
 sizeof(*cm->above_context));
 if (!cm->above_context) goto fail;

    vpx_free(cm->above_seg_context);
    cm->above_seg_context = (PARTITION_CONTEXT *)vpx_calloc(
        mi_cols_aligned_to_sb(cm->mi_cols), sizeof(*cm->above_seg_context));
 if (!cm->above_seg_context) goto fail;
    cm->above_context_alloc_cols = cm->mi_cols;
 }


   return 0;
 
  fail:
   vp9_free_context_buffers(cm);
   return 1;
 }
Commit message: None
CVE: CVE-2016-6699
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622.

Project: Android

status_t MediaHTTP::connect(
 const char *uri,
 const KeyedVector<String8, String8> *headers,
 off64_t /* offset */) {
 if (mInitCheck != OK) {
 return mInitCheck;
 }

 KeyedVector<String8, String8> extHeaders;
 if (headers != NULL) {
        extHeaders = *headers;
 }

 if (extHeaders.indexOfKey(String8("User-Agent")) < 0) {

         extHeaders.add(String8("User-Agent"), String8(MakeUserAgent().c_str()));
     }
 
    bool success = mHTTPConnection->connect(uri, &extHeaders);
 
     mLastHeaders = extHeaders;
    mLastURI = uri;
 
     mCachedSizeValid = false;
 
     if (success) {
        AString sanitized = uriDebugString(uri);
         mName = String8::format("MediaHTTP(%s)", sanitized.c_str());
     }
 
 return success ? OK : UNKNOWN_ERROR;
}
Commit message: None
CVE: CVE-2016-3924
CWE: CWE-200
Vulnerability description: services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate EFFECT_CMD_SET_PARAM and EFFECT_CMD_SET_PARAM_DEFERRED commands, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 30204301.

Project: Android

 status_t AudioFlinger::EffectModule::command(uint32_t cmdCode,
                                              uint32_t cmdSize,
                                              void *pCmdData,
 uint32_t *replySize,
 void *pReplyData)
{
 Mutex::Autolock _l(mLock);
    ALOGVV("command(), cmdCode: %d, mEffectInterface: %p", cmdCode, mEffectInterface);

 if (mState == DESTROYED || mEffectInterface == NULL) {
 return NO_INIT;
 }
 if (mStatus != NO_ERROR) {
 return mStatus;
 }
 if (cmdCode == EFFECT_CMD_GET_PARAM &&
 (*replySize < sizeof(effect_param_t) ||
 ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t))) {

         android_errorWriteLog(0x534e4554, "29251553");
         return -EINVAL;
     }
     status_t status = (*mEffectInterface)->command(mEffectInterface,
                                                    cmdCode,
                                                    cmdSize,
                                                   pCmdData,
                                                   replySize,
                                                   pReplyData);
 if (cmdCode != EFFECT_CMD_GET_PARAM && status == NO_ERROR) {
 uint32_t size = (replySize == NULL) ? 0 : *replySize;
 for (size_t i = 1; i < mHandles.size(); i++) {
 EffectHandle *h = mHandles[i];
 if (h != NULL && !h->destroyed_l()) {
                h->commandExecuted(cmdCode, cmdSize, pCmdData, size, pReplyData);
 }
 }
 }
 return status;
}
Commit message: None
CVE: CVE-2016-3913
CWE: CWE-264
Vulnerability description: media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain static_cast operation, which allows attackers to gain privileges via a crafted application, aka internal bug 30204103.

Project: Android

status_t MediaPlayerService::Client::setNextPlayer(const sp<IMediaPlayer>& player) {

     ALOGV("setNextPlayer");
     Mutex::Autolock l(mLock);
     sp<Client> c = static_cast<Client*>(player.get());
     mNextClient = c;
 
     if (c != NULL) {
 if (mAudioOutput != NULL) {
            mAudioOutput->setNextOutput(c->mAudioOutput);
 } else if ((mPlayer != NULL) && !mPlayer->hardwareOutput()) {
            ALOGE("no current audio output");
 }

 if ((mPlayer != NULL) && (mNextClient->getPlayer() != NULL)) {
            mPlayer->setNextPlayer(mNextClient->getPlayer());
 }
 }

 return OK;
}
Commit message: None
CVE: CVE-2016-3900
CWE: CWE-264
Vulnerability description: cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka internal bug 29431260.

Project: Android

static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)

 {
     const char *perm = "add";
 
    if (uid >= AID_APP) {
         return 0; /* Don't allow apps to register services */
     }
 
 return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
}
Commit message: None
CVE: CVE-2016-3890
CWE: CWE-264
Vulnerability description: The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.

Project: Android

void close_all_sockets(atransport* t) {
    asocket* s;

 /* this is a little gross, but since s->close() *will* modify
    ** the list out from under you, your options are limited.
    */
    std::lock_guard<std::recursive_mutex> lock(local_socket_list_lock);

 restart:
     for (s = local_socket_list.next; s != &local_socket_list; s = s->next) {
         if (s->transport == t || (s->peer && s->peer->transport == t)) {
            local_socket_close(s);
             goto restart;
         }
     }
}
Commit message: None
CVE: CVE-2016-3881
CWE: CWE-119
Vulnerability description: The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows remote attackers to cause a denial of service (buffer over-read, and device hang or reboot) via a crafted media file, aka internal bug 30013856.

Project: Android

static vpx_codec_err_t decoder_peek_si_internal(const uint8_t *data,
 unsigned int data_sz,
 vpx_codec_stream_info_t *si,
 int *is_intra_only,

                                                 vpx_decrypt_cb decrypt_cb,
                                                 void *decrypt_state) {
   int intra_only_flag = 0;
  uint8_t clear_buffer[9];
 
   if (data + data_sz <= data)
     return VPX_CODEC_INVALID_PARAM;

  si->is_kf = 0;
  si->w = si->h = 0;

 if (decrypt_cb) {
    data_sz = VPXMIN(sizeof(clear_buffer), data_sz);
    decrypt_cb(decrypt_state, data, clear_buffer, data_sz);

     data = clear_buffer;
   }
 
   {
     int show_frame;
     int error_resilient;
 struct vpx_read_bit_buffer rb = { data, data + data_sz, 0, NULL, NULL };
 const int frame_marker = vpx_rb_read_literal(&rb, 2);
 const BITSTREAM_PROFILE profile = vp9_read_profile(&rb);

 if (frame_marker != VP9_FRAME_MARKER)
 return VPX_CODEC_UNSUP_BITSTREAM;


     if (profile >= MAX_PROFILES)
       return VPX_CODEC_UNSUP_BITSTREAM;
 
    if ((profile >= 2 && data_sz <= 1) || data_sz < 1)
      return VPX_CODEC_UNSUP_BITSTREAM;
     if (vpx_rb_read_bit(&rb)) {  // show an existing frame
       vpx_rb_read_literal(&rb, 3);  // Frame buffer to show.
       return VPX_CODEC_OK;
     }
 
    if (data_sz <= 8)
       return VPX_CODEC_UNSUP_BITSTREAM;
 
     si->is_kf = !vpx_rb_read_bit(&rb);
    show_frame = vpx_rb_read_bit(&rb);
    error_resilient = vpx_rb_read_bit(&rb);

 if (si->is_kf) {
 if (!vp9_read_sync_code(&rb))
 return VPX_CODEC_UNSUP_BITSTREAM;

 if (!parse_bitdepth_colorspace_sampling(profile, &rb))
 return VPX_CODEC_UNSUP_BITSTREAM;
      vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
 } else {
      intra_only_flag = show_frame ? 0 : vpx_rb_read_bit(&rb);

      rb.bit_offset += error_resilient ? 0 : 2; // reset_frame_context

 if (intra_only_flag) {
 if (!vp9_read_sync_code(&rb))
 return VPX_CODEC_UNSUP_BITSTREAM;
 if (profile > PROFILE_0) {
 if (!parse_bitdepth_colorspace_sampling(profile, &rb))
 return VPX_CODEC_UNSUP_BITSTREAM;
 }
        rb.bit_offset += REF_FRAMES; // refresh_frame_flags
        vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
 }
 }
 }
 if (is_intra_only != NULL)
 *is_intra_only = intra_only_flag;
 return VPX_CODEC_OK;
}
Commit message: None
CVE: CVE-2016-3872
CWE: CWE-119
Vulnerability description: Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to gain privileges via a crafted application, aka internal bug 29421675.

Project: Android

bool SoftVPX::outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader) {
 uint32_t width = outputBufferWidth();
 uint32_t height = outputBufferHeight();

     uint64_t nFilledLen = width;
     nFilledLen *= height;
     if (nFilledLen > UINT32_MAX / 3) {
        ALOGE("b/29421675, nFilledLen overflow %llu w %u h %u", nFilledLen, width, height);
         android_errorWriteLog(0x534e4554, "29421675");
         return false;
     } else if (outHeader->nAllocLen < outHeader->nFilledLen) {
        ALOGE("b/27597103, buffer too small");
        android_errorWriteLog(0x534e4554, "27597103");
 return false;
 }

 return true;
}
Commit message: None
CVE: CVE-2016-3870
CWE: CWE-264
Vulnerability description: omx/SimpleSoftOMXComponent.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not prevent input-port changes, which allows attackers to gain privileges via a crafted application, aka internal bug 29421804.

Project: Android

void SimpleSoftOMXComponent::onPortEnable(OMX_U32 portIndex, bool enable) {
    CHECK_LT(portIndex, mPorts.size());

 PortInfo *port = &mPorts.editItemAt(portIndex);

     CHECK_EQ((int)port->mTransition, (int)PortInfo::NONE);
     CHECK(port->mDef.bEnabled == !enable);
 
     if (!enable) {
         port->mDef.bEnabled = OMX_FALSE;
         port->mTransition = PortInfo::DISABLING;

 for (size_t i = 0; i < port->mBuffers.size(); ++i) {
 BufferInfo *buffer = &port->mBuffers.editItemAt(i);

 if (buffer->mOwnedByUs) {
                buffer->mOwnedByUs = false;

 if (port->mDef.eDir == OMX_DirInput) {
                    notifyEmptyBufferDone(buffer->mHeader);
 } else {
                    CHECK_EQ(port->mDef.eDir, OMX_DirOutput);
                    notifyFillBufferDone(buffer->mHeader);
 }
 }
 }

        port->mQueue.clear();
 } else {
        port->mTransition = PortInfo::ENABLING;
 }

    checkTransitions();
}
Commit message: None
CVE: CVE-2016-3837
CWE: CWE-200
Vulnerability description: service/jni/com_android_server_wifi_WifiNative.cpp in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a crafted application that provides a MAC address with too few characters, aka internal bug 28164077.

Project: Android

 static byte parseHexByte(const char * &str) {
     byte b = parseHexChar(str[0]);
    if (str[1] == ':' || str[1] == '\0') {
        str += 2;
        return b;
     } else {
         b = b << 4 | parseHexChar(str[1]);
        str += 3;
        return b;
     }
 }
Commit message: None
CVE: CVE-2016-3826
CWE: CWE-20
Vulnerability description: services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the reply size for an AudioFlinger effect command, which allows attackers to gain privileges via a crafted application, aka internal bug 29251553.

Project: Android

status_t AudioFlinger::EffectModule::command(uint32_t cmdCode,
 uint32_t cmdSize,
 void *pCmdData,
 uint32_t *replySize,
 void *pReplyData)
{
 Mutex::Autolock _l(mLock);
    ALOGVV("command(), cmdCode: %d, mEffectInterface: %p", cmdCode, mEffectInterface);

 if (mState == DESTROYED || mEffectInterface == NULL) {
 return NO_INIT;
 }

     if (mStatus != NO_ERROR) {
         return mStatus;
     }
     status_t status = (*mEffectInterface)->command(mEffectInterface,
                                                    cmdCode,
                                                    cmdSize,
                                                   pCmdData,
                                                   replySize,
                                                   pReplyData);
 if (cmdCode != EFFECT_CMD_GET_PARAM && status == NO_ERROR) {
 uint32_t size = (replySize == NULL) ? 0 : *replySize;
 for (size_t i = 1; i < mHandles.size(); i++) {
 EffectHandle *h = mHandles[i];
 if (h != NULL && !h->destroyed_l()) {
                h->commandExecuted(cmdCode, cmdSize, pCmdData, size, pReplyData);
 }
 }
 }
 return status;
}
Commit message: None
CVE: CVE-2016-3819
CWE: CWE-119
Vulnerability description: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562.

Project: Android

u32 h264bsdInitDpb(
 dpbStorage_t *dpb,
  u32 picSizeInMbs,
  u32 dpbSize,
  u32 maxRefFrames,
  u32 maxFrameNum,
  u32 noReordering)
{

/* Variables */

    u32 i;

/* Code */

    ASSERT(picSizeInMbs);
    ASSERT(maxRefFrames <= MAX_NUM_REF_PICS);
    ASSERT(maxRefFrames <= dpbSize);

     ASSERT(maxFrameNum);
     ASSERT(dpbSize);
 
     dpb->maxLongTermFrameIdx = NO_LONG_TERM_FRAME_INDICES;
     dpb->maxRefFrames        = MAX(maxRefFrames, 1);
     if (noReordering)
        dpb->dpbSize         = dpb->maxRefFrames;
 else
        dpb->dpbSize         = dpbSize;
    dpb->maxFrameNum         = maxFrameNum;
    dpb->noReordering        = noReordering;
    dpb->fullness            = 0;
    dpb->numRefFrames        = 0;
    dpb->prevRefFrameNum     = 0;

    ALLOCATE(dpb->buffer, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t);
 if (dpb->buffer == NULL)
 return(MEMORY_ALLOCATION_ERROR);
    H264SwDecMemset(dpb->buffer, 0,
 (MAX_NUM_REF_IDX_L0_ACTIVE + 1)*sizeof(dpbPicture_t));
 for (i = 0; i < dpb->dpbSize + 1; i++)
 {
 /* Allocate needed amount of memory, which is:
         * image size + 32 + 15, where 32 cames from the fact that in ARM OpenMax
         * DL implementation Functions may read beyond the end of an array,
         * by a maximum of 32 bytes. And +15 cames for the need to align memory
         * to 16-byte boundary */
        ALLOCATE(dpb->buffer[i].pAllocatedData, (picSizeInMbs*384 + 32+15), u8);
 if (dpb->buffer[i].pAllocatedData == NULL)
 return(MEMORY_ALLOCATION_ERROR);

        dpb->buffer[i].data = ALIGN(dpb->buffer[i].pAllocatedData, 16);
 }

    ALLOCATE(dpb->list, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t*);
    ALLOCATE(dpb->outBuf, dpb->dpbSize+1, dpbOutPicture_t);

 if (dpb->list == NULL || dpb->outBuf == NULL)
 return(MEMORY_ALLOCATION_ERROR);

    H264SwDecMemset(dpb->list, 0,
 ((MAX_NUM_REF_IDX_L0_ACTIVE + 1) * sizeof(dpbPicture_t*)) );

    dpb->numOut = dpb->outIndex = 0;

 return(HANTRO_OK);

}
Commit message: None
CVE: CVE-2016-3765
CWE: CWE-200
Vulnerability description: decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application, aka internal bug 28168413.

Project: Android

 INLINE void impeg2d_bit_stream_flush(void* pv_ctxt, UWORD32 u4_no_of_bits)
 {
     stream_t *ps_stream = (stream_t *)pv_ctxt;
    if (ps_stream->u4_offset < ps_stream->u4_max_offset)
     {
         FLUSH_BITS(ps_stream->u4_offset,ps_stream->u4_buf,ps_stream->u4_buf_nxt,u4_no_of_bits,ps_stream->pu4_buf_aligned)
     }
     return;
 }