Commit message: None
CVE: CVE-2017-0594
CWE: CWE-120
Vulnerability description: An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34617444.

Project: Android

OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
        OMX_INDEXTYPE index, OMX_PTR params) {
 switch ((OMX_U32) index) {
 case OMX_IndexParamAudioPortFormat:
 {
            OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
 (OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;

 if (!isValidOMXParam(formatParams)) {
 return OMX_ErrorBadParameter;
 }

 if (formatParams->nPortIndex > 1) {
 return OMX_ErrorUndefined;
 }

 if (formatParams->nIndex > 0) {
 return OMX_ErrorNoMore;
 }

            formatParams->eEncoding =
 (formatParams->nPortIndex == 0)
 ? OMX_AUDIO_CodingPCM : OMX_AUDIO_CodingAAC;

 return OMX_ErrorNone;
 }

 case OMX_IndexParamAudioAac:
 {
            OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
 (OMX_AUDIO_PARAM_AACPROFILETYPE *)params;

 if (!isValidOMXParam(aacParams)) {
 return OMX_ErrorBadParameter;
 }

 if (aacParams->nPortIndex != 1) {
 return OMX_ErrorUndefined;
 }

            aacParams->nBitRate = mBitRate;
            aacParams->nAudioBandWidth = 0;
            aacParams->nAACtools = 0;
            aacParams->nAACERtools = 0;
            aacParams->eAACProfile = (OMX_AUDIO_AACPROFILETYPE) mAACProfile;
            aacParams->eAACStreamFormat = OMX_AUDIO_AACStreamFormatMP4FF;
            aacParams->eChannelMode = OMX_AUDIO_ChannelModeStereo;

            aacParams->nChannels = mNumChannels;
            aacParams->nSampleRate = mSampleRate;
            aacParams->nFrameLength = 0;

 switch (mSBRMode) {
 case 1: // sbr on
 switch (mSBRRatio) {
 case 0:
                    aacParams->nAACtools |= OMX_AUDIO_AACToolAndroidSSBR;
                    aacParams->nAACtools |= OMX_AUDIO_AACToolAndroidDSBR;
 break;
 case 1:
                    aacParams->nAACtools |= OMX_AUDIO_AACToolAndroidSSBR;
                    aacParams->nAACtools &= ~OMX_AUDIO_AACToolAndroidDSBR;
 break;
 case 2:
                    aacParams->nAACtools &= ~OMX_AUDIO_AACToolAndroidSSBR;
                    aacParams->nAACtools |= OMX_AUDIO_AACToolAndroidDSBR;
 break;
 default:
                    ALOGE("invalid SBR ratio %d", mSBRRatio);
                    TRESPASS();
 }
 break;
 case 0: // sbr off
 case -1: // sbr undefined
                aacParams->nAACtools &= ~OMX_AUDIO_AACToolAndroidSSBR;
                aacParams->nAACtools &= ~OMX_AUDIO_AACToolAndroidDSBR;
 break;
 default:
                ALOGE("invalid SBR mode %d", mSBRMode);
                TRESPASS();
 }



 return OMX_ErrorNone;
 }

 case OMX_IndexParamAudioPcm:
 {
            OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
 (OMX_AUDIO_PARAM_PCMMODETYPE *)params;

 if (!isValidOMXParam(pcmParams)) {
 return OMX_ErrorBadParameter;
 }

 if (pcmParams->nPortIndex != 0) {
 return OMX_ErrorUndefined;
 }

            pcmParams->eNumData = OMX_NumericalDataSigned;
            pcmParams->eEndian = OMX_EndianBig;
            pcmParams->bInterleaved = OMX_TRUE;
            pcmParams->nBitPerSample = 16;
            pcmParams->ePCMMode = OMX_AUDIO_PCMModeLinear;
            pcmParams->eChannelMapping[0] = OMX_AUDIO_ChannelLF;
            pcmParams->eChannelMapping[1] = OMX_AUDIO_ChannelRF;

            pcmParams->nChannels = mNumChannels;
            pcmParams->nSamplingRate = mSampleRate;

 return OMX_ErrorNone;
 }

 case OMX_IndexParamAudioProfileQuerySupported:
 {
            OMX_AUDIO_PARAM_ANDROID_PROFILETYPE *profileParams =
 (OMX_AUDIO_PARAM_ANDROID_PROFILETYPE *)params;

 if (!isValidOMXParam(profileParams)) {
 return OMX_ErrorBadParameter;
 }

 if (profileParams->nPortIndex != 1) {
 return OMX_ErrorUndefined;
 }

 if (profileParams->nProfileIndex >= NELEM(kSupportedProfiles)) {
 return OMX_ErrorNoMore;
 }

            profileParams->eProfile =
                kSupportedProfiles[profileParams->nProfileIndex];

 return OMX_ErrorNone;
 }

 default:
 return SimpleSoftOMXComponent::internalGetParameter(index, params);
 }
}

Project: Android

void SoftAACEncoder2::onReset() {
 delete[] mInputFrame;
    mInputFrame = NULL;
    mInputSize = 0;

    mSentCodecSpecificData = false;
    mInputTimeUs = -1ll;
    mSawInputEOS = false;
    mSignalledError = false;
}

Project: Android

SoftAACEncoder2::~SoftAACEncoder2() {
    aacEncClose(&mAACEncoder);

    onReset();
}