{"push_id":752817735,"size":10,"distinct_size":8,"ref":"refs/heads/caf/LNX.LA.3.7.1_rb3.2","head":"f5bae6f9588c48ec000d3fd507d70e9c235f278c","before":"de5b9cb1497f66d08d458abf1560aff6286abe17","commits":[{"sha":"b1564d5b822af701517e2a97a61d8cac775bed74","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent integer overflow when processing covr MPEG4 atoms\n\nIf the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur\nand cause an undersized buffer to be allocated. The following processing\nthen overfills the resulting memory and creates a potentially exploitable\ncondition. Ensure that integer overflow does not occur.\n\nBug: 20923261\nChange-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/b1564d5b822af701517e2a97a61d8cac775bed74"},{"sha":"d4ea1b9cc96a910ba01c5e513b43f0629b0cab52","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer underflow in covr MPEG4 processing\n\nWhen the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an\ninteger underflow can occur. This causes an extraordinarily large value to\nbe passed to MetaData::setData, leading to a buffer overflow.\n\nBug: 20923261\nChange-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/d4ea1b9cc96a910ba01c5e513b43f0629b0cab52"},{"sha":"a5478da3bed5984ee0b893e558f1b3160956cfc9","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge d4ea1b9cc96a910ba01c5e513b43f0629b0cab52 on remote branch\n\nChange-Id: I9e764197f1bfdeea17e5e83710ee1b52af54d085","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/a5478da3bed5984ee0b893e558f1b3160956cfc9"},{"sha":"21308ab3441090d4cc4c6cb5e7459bf4e06f8b5f","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer overflow when handling MPEG4 tx3g atom\n\nWhen the sum of the 'size' and 'chunk_size' variables is larger than 2^32,\nan integer overflow occurs. Using the result value to allocate memory\nleads to an undersized buffer allocation and later a potentially\nexploitable heap corruption condition. Ensure that integer overflow does\nnot occur.\n\nBug:  20923261\nChange-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/21308ab3441090d4cc4c6cb5e7459bf4e06f8b5f"},{"sha":"9cdca194df32fde49a7dccbe11105eb3120e5edd","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix several ineffective integer overflow checks\n\nCommit edd4a76 (which addressed bugs 15328708, 15342615, 15342751) added\nseveral integer overflow checks. Unfortunately, those checks fail to take into\naccount integer promotion rules and are thus themselves subject to an integer\noverflow. Cast the sizeof() operator to a uint64_t to force promotion while\nmultiplying.\n\nBug: 20139950\n\n(cherry picked from commit e2e812e58e8d2716b00d7d82db99b08d3afb4b32)\n\nChange-Id: I080eb3fa147601f18cedab86e0360406c3963d7b","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/9cdca194df32fde49a7dccbe11105eb3120e5edd"},{"sha":"ebd2b67a26efe1a1cc1d9381958eef2e0ac1b8e1","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer overflow during MP4 atom processing\n\nA few sample table related FourCC values are handled by the\nsetSampleToChunkParams function. An integer overflow exists within this\nfunction. Validate that mNumSampleToChunkOffets will not cause an integer\noverflow.\n\nBug: 20139950\n\n(cherry picked from commit c24607c29c96f939aed9e33bfa702b1dd79da4b7)\n\nChange-Id: I49086952451b09a234d8b82669251ab9f1ef58d9","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/ebd2b67a26efe1a1cc1d9381958eef2e0ac1b8e1"},{"sha":"a4da2c07fadca100ee75f3af2ac4e3d22a9f33e5","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer underflow in ESDS processing\n\nSeveral arithmetic operations within parseESDescriptor could underflow, leading\nto an out-of-bounds read operation. Ensure that subtractions from 'size' do not\ncause it to wrap around.\n\nBug: 20139950\n\n(cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)\n\nChange-Id: I377d21051e07ca654ea1f7037120429d3f71924a","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/a4da2c07fadca100ee75f3af2ac4e3d22a9f33e5"},{"sha":"4559b63b9177a3c483ee934fc55b6bf15a5882b2","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge d4ea1b9cc96a910ba01c5e513b43f0629b0cab52 on remote branch\"","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/4559b63b9177a3c483ee934fc55b6bf15a5882b2"},{"sha":"bef9fe60a29bb4dfef3709983ea9df4e2b71ad90","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Fix integer underflow in ESDS processing\"","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/bef9fe60a29bb4dfef3709983ea9df4e2b71ad90"},{"sha":"f5bae6f9588c48ec000d3fd507d70e9c235f278c","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Fix integer overflow when handling MPEG4 tx3g atom\"","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-frameworks-av/commits/f5bae6f9588c48ec000d3fd507d70e9c235f278c"}]}