db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2016-0804
CWE: CWE-119
Vulnerability description: The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.

Project: Android

void NuPlayer::GenericSource::notifyPreparedAndCleanup(status_t err) {
 if (err != OK) {
        mMetaDataSize = -1ll;
        mContentType = "";
        mSniffedMIME = "";
 {
            sp<DataSource> dataSource = mDataSource;
            sp<NuCachedSource2> cachedSource = mCachedSource;
            sp<DataSource> httpSource = mHttpSource;

             {
                 Mutex::Autolock _l(mDisconnectLock);
                 mDataSource.clear();
                mDrmManagerClient = NULL;
                 mCachedSource.clear();
                 mHttpSource.clear();
             }
 }

        cancelPollBuffering();
 }
    notifyPrepared(err);
}
Commit message: None
CVE: CVE-2015-6640
CWE: CWE-264
Vulnerability description: The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.

Project: Android

static int prctl_set_vma_anon_name(unsigned long start, unsigned long end,
 unsigned long arg)
{
 unsigned long tmp;
 struct vm_area_struct * vma, *prev;
 int unmapped_error = 0;
 int error = -EINVAL;

 /*
	 * If the interval [start,end) covers some unmapped address
	 * ranges, just ignore them, but return -ENOMEM at the end.
	 * - this matches the handling in madvise.
	 */
	vma = find_vma_prev(current->mm, start, &prev);
 if (vma && start > vma->vm_start)
		prev = vma;

 for (;;) {
 /* Still start < end. */
		error = -ENOMEM;
 if (!vma)
 return error;

 /* Here start < (end|vma->vm_end). */
 if (start < vma->vm_start) {
			unmapped_error = -ENOMEM;
			start = vma->vm_start;
 if (start >= end)
 return error;
 }

 /* Here vma->vm_start <= start < (end|vma->vm_end) */
		tmp = vma->vm_end;
 if (end < tmp)

 			tmp = end;
 
 		/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */
		error = prctl_update_vma_anon_name(vma, &prev, start, tmp,
 				(const char __user *)arg);
 		if (error)
 			return error;
		start = tmp;
 if (prev && start < prev->vm_end)
			start = prev->vm_end;
		error = unmapped_error;
 if (start >= end)
 return error;
 if (prev)
			vma = prev->vm_next;
 else /* madvise_remove dropped mmap_sem */
			vma = find_vma(current->mm, start);
 }
}
Commit message: None
CVE: CVE-2017-0818
CWE: CWE-772
Vulnerability description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671.

Project: Android

status_t MyOpusExtractor::readNextPacket(MediaBuffer **out) {
 if (mOffset <= mFirstDataOffset && mStartGranulePosition < 0) {
 MediaBuffer *mBuf;
 uint32_t numSamples = 0;
 uint64_t curGranulePosition = 0;
 while (true) {
 status_t err = _readNextPacket(&mBuf, /* calcVorbisTimestamp = */false);
 if (err != OK && err != ERROR_END_OF_STREAM) {
 return err;

             }
             if (err == ERROR_END_OF_STREAM || mCurrentPage.mPageNo > 2) {
                if (mBuf != NULL) {
                    mBuf->release();
                    mBuf = NULL;
                }
                 break;
             }
             curGranulePosition = mCurrentPage.mGranulePosition;
            numSamples += getNumSamplesInPacket(mBuf);
            mBuf->release();
            mBuf = NULL;
 }

 if (curGranulePosition > numSamples) {
            mStartGranulePosition = curGranulePosition - numSamples;
 } else {
            mStartGranulePosition = 0;
 }
        seekToOffset(0);
 }

 status_t err = _readNextPacket(out, /* calcVorbisTimestamp = */false);
 if (err != OK) {
 return err;
 }

 int32_t currentPageSamples;
 if ((*out)->meta_data()->findInt32(kKeyValidSamples, &currentPageSamples)) {
 if (mOffset == mFirstDataOffset) {
            currentPageSamples -= mStartGranulePosition;
 (*out)->meta_data()->setInt32(kKeyValidSamples, currentPageSamples);
 }
        mCurGranulePosition = mCurrentPage.mGranulePosition - currentPageSamples;
 }

 int64_t timeUs = getTimeUsOfGranule(mCurGranulePosition);
 (*out)->meta_data()->setInt64(kKeyTime, timeUs);

 uint32_t frames = getNumSamplesInPacket(*out);
    mCurGranulePosition += frames;
 return OK;
}
Commit message: None
CVE: CVE-2017-0813
CWE: CWE-772
Vulnerability description: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046.

Project: Android

status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) {
 if (mSyncSampleOffset >= 0 || data_size < 8) {
 return ERROR_MALFORMED;
 }

 uint8_t header[8];
 if (mDataSource->readAt(
                data_offset, header, sizeof(header)) < (ssize_t)sizeof(header)) {
 return ERROR_IO;
 }

 if (U32_AT(header) != 0) {
 return ERROR_MALFORMED;
 }

 uint32_t numSyncSamples = U32_AT(&header[4]);

 if (numSyncSamples < 2) {
        ALOGV("Table of sync samples is empty or has only a single entry!");
 }

 uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);
 if (allocSize > kMaxTotalSize) {
        ALOGE("Sync sample table size too large.");
 return ERROR_OUT_OF_RANGE;
 }

    mTotalSize += allocSize;
 if (mTotalSize > kMaxTotalSize) {
        ALOGE("Sync sample table size would make sample table too large.\n"
 "    Requested sync sample table size = %llu\n"
 "    Eventual sample table size >= %llu\n"
 "    Allowed sample table size = %llu\n",
 (unsigned long long)allocSize,
 (unsigned long long)mTotalSize,
 (unsigned long long)kMaxTotalSize);
 return ERROR_OUT_OF_RANGE;
 }

    mSyncSamples = new (std::nothrow) uint32_t[numSyncSamples];
 if (!mSyncSamples) {
        ALOGE("Cannot allocate sync sample table with %llu entries.",
 (unsigned long long)numSyncSamples);
 return ERROR_OUT_OF_RANGE;
 }

 
     if (mDataSource->readAt(data_offset + 8, mSyncSamples,
             (size_t)allocSize) != (ssize_t)allocSize) {
        delete[] mSyncSamples;
         mSyncSamples = NULL;
         return ERROR_IO;
     }

 for (size_t i = 0; i < numSyncSamples; ++i) {
 if (mSyncSamples[i] == 0) {
            ALOGE("b/32423862, unexpected zero value in stss");
 continue;
 }
        mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
 }

    mSyncSampleOffset = data_offset;
    mNumSyncSamples = numSyncSamples;

 return OK;
}
Commit message: None
CVE: CVE-2017-0635
CWE: CWE-476
Vulnerability description: A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Low due to details specific to the vulnerability. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35467107.

Project: Android

 status_t HevcParameterSets::addNalUnit(const uint8_t* data, size_t size) {
    if (size < 1) {
        ALOGE("empty NAL b/35467107");
        return ERROR_MALFORMED;
    }
     uint8_t nalUnitType = (data[0] >> 1) & 0x3f;
     status_t err = OK;
     switch (nalUnitType) {
         case 32:  // VPS
            if (size < 2) {
                ALOGE("invalid NAL/VPS size b/35467107");
                return ERROR_MALFORMED;
            }
             err = parseVps(data + 2, size - 2);
             break;
         case 33:  // SPS
            if (size < 2) {
                ALOGE("invalid NAL/SPS size b/35467107");
                return ERROR_MALFORMED;
            }
             err = parseSps(data + 2, size - 2);
             break;
         case 34:  // PPS
            if (size < 2) {
                ALOGE("invalid NAL/PPS size b/35467107");
                return ERROR_MALFORMED;
            }
             err = parsePps(data + 2, size - 2);
             break;
         case 39:  // Prefix SEI
 case 40: // Suffix SEI
 break;
 default:
            ALOGE("Unrecognized NAL unit type.");
 return ERROR_MALFORMED;
 }

 if (err != OK) {
 return err;
 }

    sp<ABuffer> buffer = ABuffer::CreateAsCopy(data, size);
    buffer->setInt32Data(nalUnitType);
    mNalUnits.push(buffer);
 return OK;
}
Commit message: None
CVE: CVE-2017-0541
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018.

Project: Android

static EAS_RESULT PushcdlStack (EAS_U32 *pStack, EAS_INT *pStackPtr, EAS_U32 value)

 {
 
     /* stack overflow, return an error */
    if (*pStackPtr >= (CDL_STACK_SIZE - 1)) {
        ALOGE("b/34031018, stackPtr(%d)", *pStackPtr);
        android_errorWriteLog(0x534e4554, "34031018");
         return EAS_ERROR_FILE_FORMAT;
    }
 
     /* push the value onto the stack */
     *pStackPtr = *pStackPtr + 1;
    pStack[*pStackPtr] = value;
 return EAS_SUCCESS;
}
Commit message: None
CVE: CVE-2017-0392
Vulnerability description: A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32577290.

Project: Android

sp<VBRISeeker> VBRISeeker::CreateFromSource(
 const sp<DataSource> &source, off64_t post_id3_pos) {
 off64_t pos = post_id3_pos;

 uint8_t header[4];
 ssize_t n = source->readAt(pos, header, sizeof(header));
 if (n < (ssize_t)sizeof(header)) {
 return NULL;
 }

 uint32_t tmp = U32_AT(&header[0]);
 size_t frameSize;
 int sampleRate;
 if (!GetMPEGAudioFrameSize(tmp, &frameSize, &sampleRate)) {
 return NULL;
 }

    pos += sizeof(header) + 32;

 uint8_t vbriHeader[26];
    n = source->readAt(pos, vbriHeader, sizeof(vbriHeader));
 if (n < (ssize_t)sizeof(vbriHeader)) {
 return NULL;
 }

 if (memcmp(vbriHeader, "VBRI", 4)) {
 return NULL;
 }

 size_t numFrames = U32_AT(&vbriHeader[14]);

 int64_t durationUs =
        numFrames * 1000000ll * (sampleRate >= 32000 ? 1152 : 576) / sampleRate;

    ALOGV("duration = %.2f secs", durationUs / 1E6);

 size_t numEntries = U16_AT(&vbriHeader[18]);
 size_t entrySize = U16_AT(&vbriHeader[22]);
 size_t scale = U16_AT(&vbriHeader[20]);

    ALOGV("%zu entries, scale=%zu, size_per_entry=%zu",
         numEntries,

          scale,
          entrySize);
 
    if (entrySize > 4) {
        ALOGE("invalid VBRI entry size: %zu", entrySize);
        return NULL;
    }

    sp<VBRISeeker> seeker = new (std::nothrow) VBRISeeker;
    if (seeker == NULL) {
        ALOGW("Couldn't allocate VBRISeeker");
        return NULL;
    }

     size_t totalEntrySize = numEntries * entrySize;
    uint8_t *buffer = new (std::nothrow) uint8_t[totalEntrySize];
    if (!buffer) {
        ALOGW("Couldn't allocate %zu bytes", totalEntrySize);
        return NULL;
    }
 
     n = source->readAt(pos + sizeof(vbriHeader), buffer, totalEntrySize);
     if (n < (ssize_t)totalEntrySize) {
 delete[] buffer;
        buffer = NULL;


         return NULL;
     }
 
     seeker->mBasePos = post_id3_pos + frameSize;
 if (durationUs) {
        seeker->mDurationUs = durationUs;
 }

 off64_t offset = post_id3_pos;
 for (size_t i = 0; i < numEntries; ++i) {
 uint32_t numBytes;
 switch (entrySize) {
 case 1: numBytes = buffer[i]; break;
 case 2: numBytes = U16_AT(buffer + 2 * i); break;
 case 3: numBytes = U24_AT(buffer + 3 * i); break;
 default:
 {
                CHECK_EQ(entrySize, 4u);
                numBytes = U32_AT(buffer + 4 * i); break;
 }
 }

        numBytes *= scale;

        seeker->mSegments.push(numBytes);

        ALOGV("entry #%zu: %u offset %#016llx", i, numBytes, (long long)offset);
        offset += numBytes;
 }

 delete[] buffer;
    buffer = NULL;

    ALOGI("Found VBRI header.");

 return seeker;
}
Commit message: None
CVE: CVE-2018-9510
CWE: CWE-200
Vulnerability description: In smp_proc_enc_info of smp_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111937065

Project: Android

void smp_proc_enc_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {

   uint8_t* p = p_data->p_data;
 
   SMP_TRACE_DEBUG("%s", __func__);

  if (smp_command_has_invalid_parameters(p_cb)) {
    tSMP_INT_DATA smp_int_data;
    smp_int_data.status = SMP_INVALID_PARAMETERS;
    android_errorWriteLog(0x534e4554, "111937065");
    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
    return;
  }

   STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);
 
   smp_key_distribution(p_cb, NULL);
}

Project: Android

 void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
   uint8_t* p = p_data->p_data;
 
   SMP_TRACE_DEBUG("%s", __func__);

  if (smp_command_has_invalid_parameters(p_cb)) {
    tSMP_INT_DATA smp_int_data;
    smp_int_data.status = SMP_INVALID_PARAMETERS;
    android_errorWriteLog(0x534e4554, "111937065");
    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
    return;
  }

   STREAM_TO_ARRAY(p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */
   smp_key_distribution_by_transport(p_cb, NULL);
 }
Commit message: None
CVE: CVE-2018-9508
CWE: CWE-125
Vulnerability description: In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-111936834

Project: Android

void smp_process_keypress_notification(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
 uint8_t* p = (uint8_t*)p_data;

   uint8_t reason = SMP_INVALID_PARAMETERS;
 
   SMP_TRACE_DEBUG("%s", __func__);
 
   if (smp_command_has_invalid_parameters(p_cb)) {
    if (p_cb->rcvd_cmd_len < 2) {  // 1 (opcode) + 1 (Notif Type) bytes
      android_errorWriteLog(0x534e4554, "111936834");
    }
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
     return;
   }
 
  p_cb->status = *(uint8_t*)p_data;

   if (p != NULL) {
     STREAM_TO_UINT8(p_cb->peer_keypress_notification, p);
   } else {
    p_cb->peer_keypress_notification = BTM_SP_KEY_OUT_OF_RANGE;
 }
  p_cb->cb_evt = SMP_PEER_KEYPR_NOT_EVT;
}
Commit message: None
CVE: CVE-2018-9504
CWE: CWE-787
Vulnerability description: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-110216176

Project: Android

static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
 unsigned int cpy_len, rem_len;
 uint32_t list_len;
 uint8_t* p;
 uint8_t type;

#if (SDP_DEBUG_RAW == TRUE)
 uint8_t num_array[SDP_MAX_LIST_BYTE_COUNT];
 uint32_t i;

 for (i = 0; i < p_ccb->list_len; i++) {
    snprintf((char*)&num_array[i * 2], sizeof(num_array) - i * 2, "%02X",
 (uint8_t)(p_ccb->rsp_list[i]));
 }
  SDP_TRACE_WARNING("result :%s", num_array);
#endif

 if (p_ccb->p_db->raw_data) {
    cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used;
    list_len = p_ccb->list_len;

     p = &p_ccb->rsp_list[0];
 
     if (offset) {
      cpy_len -= 1;
       type = *p++;
      uint8_t* old_p = p;
       p = sdpu_get_len_from_type(p, type, &list_len);
      if ((int)cpy_len < (p - old_p)) {
        SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
        return;
      }
      cpy_len -= (p - old_p);
     }
     if (list_len < cpy_len) {
       cpy_len = list_len;
 }
    rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);
 if (cpy_len > rem_len) {
      SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
      cpy_len = rem_len;
 }
    SDP_TRACE_WARNING(
 "%s: list_len:%d cpy_len:%d p:%p p_ccb:%p p_db:%p raw_size:%d "
 "raw_used:%d raw_data:%p",
        __func__, list_len, cpy_len, p, p_ccb, p_ccb->p_db,
        p_ccb->p_db->raw_size, p_ccb->p_db->raw_used, p_ccb->p_db->raw_data);
    memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
    p_ccb->p_db->raw_used += cpy_len;
 }
}
Commit message: None
CVE: CVE-2018-9499
CWE: CWE-200
Vulnerability description: In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-79218474

Project: Android

 void BnCrypto::readVector(const Parcel &data, Vector<uint8_t> &vector) const {
     uint32_t size = data.readInt32();
    if (vector.insertAt((size_t)0, size) < 0) {
        vector.clear();
    }
    if (data.read(vector.editArray(), size) != NO_ERROR) {
        vector.clear();
        android_errorWriteWithInfoLog(0x534e4554, "62872384", -1, NULL, 0);
    }
 }
Commit message: None
CVE: CVE-2018-9491
CWE: CWE-190
Vulnerability description: In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111603051

Project: Android

AMediaCodecCryptoInfo *AMediaCodecCryptoInfo_new(
 int numsubsamples,
 uint8_t key[16],
 uint8_t iv[16],
 cryptoinfo_mode_t mode,
 size_t *clearbytes,

         size_t *encryptedbytes) {
 
    size_t cryptosize;
    // = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2;
    if (__builtin_mul_overflow(sizeof(size_t) * 2, numsubsamples, &cryptosize) ||
            __builtin_add_overflow(cryptosize, sizeof(AMediaCodecCryptoInfo), &cryptosize)) {
        ALOGE("crypto size overflow");
        return NULL;
    }
     AMediaCodecCryptoInfo *ret = (AMediaCodecCryptoInfo*) malloc(cryptosize);
     if (!ret) {
         ALOGE("couldn't allocate %zu bytes", cryptosize);
 return NULL;
 }
    ret->numsubsamples = numsubsamples;
    memcpy(ret->key, key, 16);
    memcpy(ret->iv, iv, 16);
    ret->mode = mode;
    ret->pattern.encryptBlocks = 0;
    ret->pattern.skipBlocks = 0;

    ret->clearbytes = (size_t*) (ret + 1); // point immediately after the struct
    ret->encryptedbytes = ret->clearbytes + numsubsamples; // point after the clear sizes

    memcpy(ret->clearbytes, clearbytes, numsubsamples * sizeof(size_t));
    memcpy(ret->encryptedbytes, encryptedbytes, numsubsamples * sizeof(size_t));

 return ret;
}
Commit message: None
CVE: CVE-2017-13200
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63100526.

Project: Android

bool ID3::removeUnsynchronizationV2_4(bool iTunesHack) {
 size_t oldSize = mSize;

 size_t offset = 0;
 while (mSize >= 10 && offset <= mSize - 10) {
 if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
 break;
 }

 size_t dataSize;
 if (iTunesHack) {
            dataSize = U32_AT(&mData[offset + 4]);
 } else if (!ParseSyncsafeInteger(&mData[offset + 4], &dataSize)) {
 return false;
 }

 if (dataSize > mSize - 10 - offset) {
 return false;
 }

 uint16_t flags = U16_AT(&mData[offset + 8]);
 uint16_t prevFlags = flags;

 if (flags & 1) {

 if (mSize < 14 || mSize - 14 < offset || dataSize < 4) {
 return false;
 }
            memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
            mSize -= 4;
            dataSize -= 4;

            flags &= ~1;
 }

 if ((flags & 2) && (dataSize >= 2)) {

 size_t readOffset = offset + 11;
 size_t writeOffset = offset + 11;
 for (size_t i = 0; i + 1 < dataSize; ++i) {
 if (mData[readOffset - 1] == 0xff
 && mData[readOffset] == 0x00) {
 ++readOffset;

                     --mSize;
                     --dataSize;
                 }
                if (i + 1 < dataSize) {
                    // Only move data if there's actually something to move.
                    // This handles the special case of the data being only [0xff, 0x00]
                    // which should be converted to just 0xff if unsynchronization is on.
                    mData[writeOffset++] = mData[readOffset++];
                }
             }
             if (readOffset <= oldSize) {
                memmove(&mData[writeOffset], &mData[readOffset], oldSize - readOffset);
 } else {
                ALOGE("b/34618607 (%zu %zu %zu %zu)", readOffset, writeOffset, oldSize, mSize);
                android_errorWriteLog(0x534e4554, "34618607");
 }

 }
        flags &= ~2;
 if (flags != prevFlags || iTunesHack) {
 WriteSyncsafeInteger(&mData[offset + 4], dataSize);
            mData[offset + 8] = flags >> 8;
            mData[offset + 9] = flags & 0xff;
 }

        offset += 10 + dataSize;
 }

    memset(&mData[mSize], 0, oldSize - mSize);

 return true;
}
Commit message: None
CVE: CVE-2017-13190
CWE: CWE-770
Vulnerability description: A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68299873.

Project: Android

WORD32 ihevcd_create(iv_obj_t *ps_codec_obj,

                            void *pv_api_ip,
                            void *pv_api_op)
 {
    ihevcd_cxa_create_ip_t *ps_create_ip;
     ihevcd_cxa_create_op_t *ps_create_op;
 
     WORD32 ret;
     codec_t *ps_codec;
    ps_create_ip = (ihevcd_cxa_create_ip_t *)pv_api_ip;
     ps_create_op = (ihevcd_cxa_create_op_t *)pv_api_op;
 
     ps_create_op->s_ivd_create_op_t.u4_error_code = 0;
    ps_codec_obj = NULL;
     ret = ihevcd_allocate_static_bufs(&ps_codec_obj, pv_api_ip, pv_api_op);
 
     /* If allocation of some buffer fails, then free buffers allocated till then */
    if(IV_FAIL == ret)
     {
        if(NULL != ps_codec_obj)
        {
            if(ps_codec_obj->pv_codec_handle)
            {
                ihevcd_free_static_bufs(ps_codec_obj);
            }
            else
            {
                void (*pf_aligned_free)(void *pv_mem_ctxt, void *pv_buf);
                void *pv_mem_ctxt;

                pf_aligned_free = ps_create_ip->s_ivd_create_ip_t.pf_aligned_free;
                pv_mem_ctxt  = ps_create_ip->s_ivd_create_ip_t.pv_mem_ctxt;
                pf_aligned_free(pv_mem_ctxt, ps_codec_obj);
            }
        }
         ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
         ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
 
 return IV_FAIL;
 }
    ps_codec = (codec_t *)ps_codec_obj->pv_codec_handle;
    ret = ihevcd_init(ps_codec);

    TRACE_INIT(NULL);
    STATS_INIT();

 return ret;
}