Commit message: None
CVE: CVE-2015-1474
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.

Project: Android

GraphicBuffer::GraphicBuffer()
 : BASE(), mOwner(ownData), mBufferMapper(GraphicBufferMapper::get()),
      mInitCheck(NO_ERROR), mId(getUniqueId())
{
    width  = 
    height = 
    stride = 
    format = 
    usage  = 0;
    handle = NULL;
}

Project: Android

GraphicBuffer::GraphicBuffer(uint32_t w, uint32_t h, 
 PixelFormat reqFormat, uint32_t reqUsage)
 : BASE(), mOwner(ownData), mBufferMapper(GraphicBufferMapper::get()),
      mInitCheck(NO_ERROR), mId(getUniqueId())
{
    width  = 
    height = 
    stride = 
    format = 
    usage  = 0;
    handle = NULL;
    mInitCheck = initSize(w, h, reqFormat, reqUsage);
}

Project: Android

GraphicBuffer::GraphicBuffer(uint32_t w, uint32_t h,
 PixelFormat inFormat, uint32_t inUsage,
 uint32_t inStride, native_handle_t* inHandle, bool keepOwnership)
 : BASE(), mOwner(keepOwnership ? ownHandle : ownNone),
      mBufferMapper(GraphicBufferMapper::get()),
      mInitCheck(NO_ERROR), mId(getUniqueId())
{
    width  = w;
    height = h;
    stride = inStride;
    format = inFormat;
    usage  = inUsage;
    handle = inHandle;
}

Project: Android

GraphicBuffer::GraphicBuffer(ANativeWindowBuffer* buffer, bool keepOwnership)
 : BASE(), mOwner(keepOwnership ? ownHandle : ownNone),
      mBufferMapper(GraphicBufferMapper::get()),
      mInitCheck(NO_ERROR), mWrappedBuffer(buffer), mId(getUniqueId())
{
    width  = buffer->width;
    height = buffer->height;
    stride = buffer->stride;
    format = buffer->format;
    usage  = buffer->usage;
    handle = buffer->handle;
}

Project: Android

void GraphicBuffer::dumpAllocationsToSystemLog()
{
 GraphicBufferAllocator::dumpToSystemLog();
}

Project: Android

status_t GraphicBuffer::flatten(void*& buffer, size_t& size, int*& fds, size_t& count) const {
 size_t sizeNeeded = GraphicBuffer::getFlattenedSize();
 if (size < sizeNeeded) return NO_MEMORY;

 size_t fdCountNeeded = GraphicBuffer::getFdCount();
 if (count < fdCountNeeded) return NO_MEMORY;

 int32_t* buf = static_cast<int32_t*>(buffer);
    buf[0] = 'GBFR';
    buf[1] = width;
    buf[2] = height;
    buf[3] = stride;
    buf[4] = format;
    buf[5] = usage;
    buf[6] = static_cast<int32_t>(mId >> 32);
    buf[7] = static_cast<int32_t>(mId & 0xFFFFFFFFull);
    buf[8] = 0;
    buf[9] = 0;

 if (handle) {
        buf[8] = handle->numFds;
        buf[9] = handle->numInts;
 native_handle_t const* const h = handle;
        memcpy(fds,     h->data,             h->numFds*sizeof(int));
        memcpy(&buf[10], h->data + h->numFds, h->numInts*sizeof(int));
 }

    buffer = reinterpret_cast<void*>(static_cast<int*>(buffer) + sizeNeeded);
    size -= sizeNeeded;
 if (handle) {
        fds += handle->numFds;
        count -= handle->numFds;
 }

 return NO_ERROR;
}

Project: Android

void GraphicBuffer::free_handle()
{
 if (mOwner == ownHandle) {
        mBufferMapper.unregisterBuffer(handle);
        native_handle_close(handle);
        native_handle_delete(const_cast<native_handle*>(handle));
 } else if (mOwner == ownData) {
 GraphicBufferAllocator& allocator(GraphicBufferAllocator::get());
        allocator.free(handle);
 }
    mWrappedBuffer = 0;
}

Project: Android

size_t GraphicBuffer::getFdCount() const {
 return handle ? handle->numFds : 0;
}

Project: Android

size_t GraphicBuffer::getFlattenedSize() const {
 return (10 + (handle ? handle->numInts : 0))*sizeof(int);
}

Project: Android

ANativeWindowBuffer* GraphicBuffer::getNativeBuffer() const
{
    LOG_ALWAYS_FATAL_IF(this == NULL, "getNativeBuffer() called on NULL GraphicBuffer");
 return static_cast<ANativeWindowBuffer*>(
 const_cast<GraphicBuffer*>(this));
}

Project: Android

static uint64_t getUniqueId() {
 static volatile int32_t nextId = 0;
 uint64_t id = static_cast<uint64_t>(getpid()) << 32;
    id |= static_cast<uint32_t>(android_atomic_inc(&nextId));
 return id;
}

Project: Android

status_t GraphicBuffer::initCheck() const {
 return mInitCheck;
}

Project: Android

status_t GraphicBuffer::initSize(uint32_t w, uint32_t h, PixelFormat format,
 uint32_t reqUsage)
{
 GraphicBufferAllocator& allocator = GraphicBufferAllocator::get();
 status_t err = allocator.alloc(w, h, format, reqUsage, &handle, &stride);
 if (err == NO_ERROR) {
 this->width  = w;
 this->height = h;
 this->format = format;
 this->usage  = reqUsage;
 }
 return err;
}

Project: Android

status_t GraphicBuffer::lock(uint32_t usage, void** vaddr)
{
 const Rect lockBounds(width, height);
 status_t res = lock(usage, lockBounds, vaddr);
 return res;
}

Project: Android

status_t GraphicBuffer::lock(uint32_t usage, const Rect& rect, void** vaddr)
{
 if (rect.left < 0 || rect.right  > this->width || 
        rect.top  < 0 || rect.bottom > this->height) {
        ALOGE("locking pixels (%d,%d,%d,%d) outside of buffer (w=%d, h=%d)",
                rect.left, rect.top, rect.right, rect.bottom, 
 this->width, this->height);
 return BAD_VALUE;
 }
 status_t res = getBufferMapper().lock(handle, usage, rect, vaddr);
 return res;
}

Project: Android

status_t GraphicBuffer::lockAsync(uint32_t usage, void** vaddr, int fenceFd)
{
 const Rect lockBounds(width, height);
 status_t res = lockAsync(usage, lockBounds, vaddr, fenceFd);
 return res;
}

Project: Android

status_t GraphicBuffer::lockAsync(uint32_t usage, const Rect& rect, void** vaddr, int fenceFd)
{
 if (rect.left < 0 || rect.right  > this->width ||
        rect.top  < 0 || rect.bottom > this->height) {
        ALOGE("locking pixels (%d,%d,%d,%d) outside of buffer (w=%d, h=%d)",
                rect.left, rect.top, rect.right, rect.bottom,
 this->width, this->height);
 return BAD_VALUE;
 }
 status_t res = getBufferMapper().lockAsync(handle, usage, rect, vaddr, fenceFd);
 return res;
}

Project: Android

status_t GraphicBuffer::lockAsyncYCbCr(uint32_t usage, android_ycbcr *ycbcr, int fenceFd)
{
 const Rect lockBounds(width, height);
 status_t res = lockAsyncYCbCr(usage, lockBounds, ycbcr, fenceFd);
 return res;
}

Project: Android

status_t GraphicBuffer::lockAsyncYCbCr(uint32_t usage, const Rect& rect, android_ycbcr *ycbcr, int fenceFd)
{
 if (rect.left < 0 || rect.right  > this->width ||
        rect.top  < 0 || rect.bottom > this->height) {
        ALOGE("locking pixels (%d,%d,%d,%d) outside of buffer (w=%d, h=%d)",
                rect.left, rect.top, rect.right, rect.bottom,
 this->width, this->height);
 return BAD_VALUE;
 }
 status_t res = getBufferMapper().lockAsyncYCbCr(handle, usage, rect, ycbcr, fenceFd);
 return res;
}

Project: Android

status_t GraphicBuffer::lockYCbCr(uint32_t usage, android_ycbcr *ycbcr)
{
 const Rect lockBounds(width, height);
 status_t res = lockYCbCr(usage, lockBounds, ycbcr);
 return res;
}

Project: Android

status_t GraphicBuffer::lockYCbCr(uint32_t usage, const Rect& rect,
        android_ycbcr *ycbcr)
{
 if (rect.left < 0 || rect.right  > this->width ||
        rect.top  < 0 || rect.bottom > this->height) {
        ALOGE("locking pixels (%d,%d,%d,%d) outside of buffer (w=%d, h=%d)",
                rect.left, rect.top, rect.right, rect.bottom,
 this->width, this->height);
 return BAD_VALUE;
 }
 status_t res = getBufferMapper().lockYCbCr(handle, usage, rect, ycbcr);
 return res;
}

Project: Android

status_t GraphicBuffer::reallocate(uint32_t w, uint32_t h, PixelFormat f,
 uint32_t reqUsage)
{
 if (mOwner != ownData)
 return INVALID_OPERATION;

 if (handle && w==width && h==height && f==format && reqUsage==usage)
 return NO_ERROR;

 if (handle) {
 GraphicBufferAllocator& allocator(GraphicBufferAllocator::get());
        allocator.free(handle);
        handle = 0;
 }
 return initSize(w, h, f, reqUsage);
}

Project: Android

status_t GraphicBuffer::unlock()
{
 status_t res = getBufferMapper().unlock(handle);
 return res;
}

Project: Android

status_t GraphicBuffer::unlockAsync(int *fenceFd)
{
 status_t res = getBufferMapper().unlockAsync(handle, fenceFd);
 return res;
}

Project: Android

GraphicBuffer::~GraphicBuffer()
{
 if (handle) {
        free_handle();
 }
}