| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
| |
Filtering digital attributes for non-digital audio devices.
Bug: 21876072
21903975
Change-Id: Ia5c81a8160f4b4ebf5941dd0c5dfb68d01699ca6
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If a session has an active explicit routing request, this routing
must also be applied to accessibility prompts if accessibility
usage is currrently remapped to the strategy used by this session.
Bug: 20873151.
Change-Id: I97c6ece98cf1af9c64c2d2eb1fe382c7c0d657b4
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Various software video decoders would specify the buffer size as if it were
fully cropped, which then failed a sanity check in SoftwareRenderer.
They now return the full buffer size.
Bug: 21717327
Bug: 21443020
Change-Id: I19fcd091827ebd52a95a5509281a07ccc156e0e5
|
| |
| |
| |
| |
| |
| | |
Bug: 20491394
Change-Id: Ide932d49e620c7dc9a847bb5ddc8715d5f936bd5
|
|\ \ |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This reverts commit 652bc0197341337bb07fc4f87f168167fb3f47dc pending
the complete investigation of b/21837661
Change-Id: I9c2825fd98ff7e9898c319ee66c0e3a3466c2093
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When decrementing "i", eventually i will equal zero. When that
happens, i-- underflows. This causes a crash when code which uses
clang's -fsanitize=unsigned-integer-overflow is run.
Avoid trigging an unsigned integer underflow.
Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12
|
|\ \ \ |
|
| | | |
| | | |
| | | |
| | | |
| | | | |
Bug: 11671194
Change-Id: Id48350264f8b5ce53bf7ce2b308bf4ba21e59241
|
|\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
e6382cb0: am 115e995c: resolved conflicts for merge of 1f44d837 to lmp-dev
* commit '7d3be41436e91a1d79b3a38c651bcd0d2c221f6d':
Fix integer overflow when handling MPEG4 tx3g atom
|
| |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
115e995c: resolved conflicts for merge of 1f44d837 to lmp-dev
* commit 'f475f6c0cf28f3b4c1ae677febb7590c70865f81':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | |\ \ \ \
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
conflicts for merge of 1f44d837 to lmp-dev
* commit 'e168bdd22042830eb436aac571fb2ea23c84b035':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | |\ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
merge of 1f44d837 to lmp-dev
* commit 'f19acf4848393acb40ef314e1a7add45e0120011':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | | |\ \ \ \
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
1f44d837 to lmp-dev
* commit '66b91b348d66102c8deb652929150446223ec767':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | | | |\ \ \ \
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | | |
* commit 'e6382cb0e9e3fcf730faac3be661c9facd939d49':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | | | | |\ \ \ \
| | | | | | | | | | |
| | | | | | | | | | |
| | | | | | | | | | |
| | | | | | | | | | | |
* commit '115e995c6b3fe7ed33e2d5d88872cb87ab4e63f0':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | | | | | |\ \ \ \
| | | | | | | | | | | |
| | | | | | | | | | | |
| | | | | | | | | | | | |
Change-Id: Id60c2470ec2afebdbc1c0c995b90e294c9c879eb
|
| | | | | | | | |\ \ \ \
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
klp-dev
* commit '82e90e10481c334bb5f2cecf1621cb8f9308c21c':
Fix integer overflow when handling MPEG4 tx3g atom
|
| | | | | | | | | |\ \ \ \ |
|
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.
Bug: 20923261
Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f
|
|\ \ \ \ \ \ \ \ \ \ \ \ \ \
| |/ / / / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
0773dc37: am 768a8fb4: am f0e1fb59: am 4a492bf2: Fix integer underflow in covr MPEG4 processing
* commit '7e2d436ff3338e42df5f31cf2aea4d0d19886b0c':
Fix integer underflow in covr MPEG4 processing
|
| |\ \ \ \ \ \ \ \ \ \ \ \ \
| | |/ / / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
768a8fb4: am f0e1fb59: am 4a492bf2: Fix integer underflow in covr MPEG4 processing
* commit '068805802f78ff82e4ba40adffc33ddcd3b0eb8f':
Fix integer underflow in covr MPEG4 processing
|
| | |\ \ \ \ \ \ \ \ \ \ \ \
| | | |/ / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
f0e1fb59: am 4a492bf2: Fix integer underflow in covr MPEG4 processing
* commit '9784b406e4da2fd34d975033722f87e496ba3ea4':
Fix integer underflow in covr MPEG4 processing
|
| | | |\ \ \ \ \ \ \ \ \ \ \
| | | | |/ / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
4a492bf2: Fix integer underflow in covr MPEG4 processing
* commit '490291898a295221b55cb44f062ec0aadeed19db':
Fix integer underflow in covr MPEG4 processing
|
| | | | |\ \ \ \ \ \ \ \ \ \
| | | | | |/ / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
underflow in covr MPEG4 processing
* commit '30b72fcf1fbb4191fb5986eade487becc39cfcd1':
Fix integer underflow in covr MPEG4 processing
|
| | | | | |\ \ \ \ \ \ \ \ \
| | | | | | |/ / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
covr MPEG4 processing
* commit '0773dc374056f46ff2d98f6421e12365968ba423':
Fix integer underflow in covr MPEG4 processing
|
| | | | | | |\ \ \ \ \ \ \ \
| | | | | | | |/ / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
processing
* commit '768a8fb4c05f524c802f8e97c9e07b73d1a196ff':
Fix integer underflow in covr MPEG4 processing
|
| | | | | | | |\ \ \ \ \ \ \
| | | | | | | | |/ / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
* commit 'f0e1fb59f3ea24ce4f7f10d156bf8470a7236445':
Fix integer underflow in covr MPEG4 processing
|
| | | | | | | | |\ \ \ \ \ \
| | | | | | | | | |/ / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
* commit '4a492bf2ac47b9844d2527e1fcdf0064c3d8d52e':
Fix integer underflow in covr MPEG4 processing
|
| | | | | | | | | |/ / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
When the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an
integer underflow can occur. This causes an extraordinarily large value to
be passed to MetaData::setData, leading to a buffer overflow.
Bug: 20923261
Change-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b
|
|\ \ \ \ \ \ \ \ \ \ \ \ \
| |/ / / / / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
e0095a19: am 86174e2c: Merge "Prevent reading past the end of the buffer in 3GPP" into lmp-dev
* commit '3056e554741facd48cec8247790bb091d574972f':
Prevent reading past the end of the buffer in 3GPP
|
| |\ \ \ \ \ \ \ \ \ \ \ \
| | |/ / / / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
86174e2c: Merge "Prevent reading past the end of the buffer in 3GPP" into lmp-dev
* commit 'c1768c9dae4e4ad1f92759c9c981d2d6e5bd29d6':
Prevent reading past the end of the buffer in 3GPP
|
| | |\ \ \ \ \ \ \ \ \ \ \
| | | |/ / / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
"Prevent reading past the end of the buffer in 3GPP" into lmp-dev
* commit '268b96927b2d0dcc63a0c8c9f546776e4ce67b7f':
Prevent reading past the end of the buffer in 3GPP
|
| | | |\ \ \ \ \ \ \ \ \ \
| | | | |/ / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
past the end of the buffer in 3GPP" into lmp-dev
* commit '9a4da6b12f08f7290f8493e7163e3271956a9aaf':
Prevent reading past the end of the buffer in 3GPP
|
| | | | |\ \ \ \ \ \ \ \ \
| | | | | |/ / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
of the buffer in 3GPP" into lmp-dev
* commit 'c98f2a0aa96c07aae6218e9e804ab18e9b50de3e':
Prevent reading past the end of the buffer in 3GPP
|
| | | | | |\ \ \ \ \ \ \ \
| | | | | | |/ / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
in 3GPP" into lmp-dev
* commit 'e0095a19666afbab36dd0e8e4544e7f4ec9f890c':
Prevent reading past the end of the buffer in 3GPP
|
| | | | | | |\ \ \ \ \ \ \
| | | | | | | |/ / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
lmp-dev
* commit '86174e2c09986b2d2ebcaf95a4a3e614bcf134ef':
Prevent reading past the end of the buffer in 3GPP
|
| | | | | | | |\ \ \ \ \ \ |
|
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
Metadata processed within the parse3GPPMetaData function may not be NUL
terminated and thus calling setCString may read out of bounds. Ensure
proper NUL termination, but take care not to interfere with other special
cases (ie, albm).
Bug: 20923261
Change-Id: Ie93b3038b534b4c4460571a68f4d734cff7ad324
(cherry picked from commit 5cea0155cfc41f67e91343c342f44251c03fde3a)
|
|\ \ \ \ \ \ \ \ \ \ \ \ \ \
| |/ / / / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
f02c5c9e: am 4d8ed149: Prevent integer underflow if size is below 6
* commit 'acf52af62fcf14d18e4a557319a7307b7ed02c94':
Prevent integer underflow if size is below 6
|
| |\ \ \ \ \ \ \ \ \ \ \ \ \
| | |/ / / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
4d8ed149: Prevent integer underflow if size is below 6
* commit 'a2a912a71e97b92edd7a73452587e0897026ec1e':
Prevent integer underflow if size is below 6
|
| | |\ \ \ \ \ \ \ \ \ \ \ \
| | | |/ / / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
integer underflow if size is below 6
* commit 'cacf9084b51572c251909ab203ab7da7c8dc038d':
Prevent integer underflow if size is below 6
|
| | | |\ \ \ \ \ \ \ \ \ \ \
| | | | |/ / / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
underflow if size is below 6
* commit '534ab954aedb19884c56a8b2b55abc6ab7184675':
Prevent integer underflow if size is below 6
|
| | | | |\ \ \ \ \ \ \ \ \ \
| | | | | |/ / / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
below 6
* commit '10441a6f3066d9ce279c478062a35a7e4e236e73':
Prevent integer underflow if size is below 6
|
| | | | | |\ \ \ \ \ \ \ \ \
| | | | | | |/ / / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
* commit 'f02c5c9e4e13a493adcf39d0cba2a549d8caa4de':
Prevent integer underflow if size is below 6
|
| | | | | | |\ \ \ \ \ \ \ \
| | | | | | | |/ / / / / / /
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
* commit '4d8ed149894eff1e21195a29d939f2ec389fe5d7':
Prevent integer underflow if size is below 6
|
| | | | | | | |/ / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
When processing 3GPP metadata, a subtraction operation may underflow and
lead to a rather large linear byteswap operation in the subsequent
framedata decoding code. Bound the 'size' value to prevent this from
occurring.
Bug: 20923261
Change-Id: I35dfbc8878c6b65cfe8b8adb7351a77ad4d604e5
(cherry picked from commit 9458e715d391ee8fe455fc31f07ff35ce12e0531)
|
|\ \ \ \ \ \ \ \ \ \ \ \ \
| |/ / / / / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
e5ca9a20: am 375e3495: IOMX: Clear buffer id for arm32
* commit '09fec7c14b3eeba465b1f382f71a88540008a3b5':
IOMX: Clear buffer id for arm32
|
| |\ \ \ \ \ \ \ \ \ \ \ \
| | |/ / / / / / / / / / /
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
375e3495: IOMX: Clear buffer id for arm32
* commit '47e94277d1e0b6f581072db8f2b5406eb30dc685':
IOMX: Clear buffer id for arm32
|