{"push_id":786623554,"size":20,"distinct_size":20,"ref":"refs/heads/lollipop","head":"b2bb0bef9474411b3d217e5d50ad0ec17b16f4bf","before":"a3beda930662c709e7525db966fb3532017f1f2c","commits":[{"sha":"cf1581c66c2ad8c5b1aaca2e43e350cf5974f46d","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix several ineffective integer overflow checks\n\nCommit edd4a76 (which addressed bugs 15328708, 15342615, 15342751) added\nseveral integer overflow checks. Unfortunately, those checks fail to take into\naccount integer promotion rules and are thus themselves subject to an integer\noverflow. Cast the sizeof() operator to a uint64_t to force promotion while\nmultiplying.\n\nBug: 20139950\n\n(cherry picked from commit e2e812e58e8d2716b00d7d82db99b08d3afb4b32)\n\nChange-Id: I080eb3fa147601f18cedab86e0360406c3963d7b","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/cf1581c66c2ad8c5b1aaca2e43e350cf5974f46d"},{"sha":"2434839bbd168469f80dd9a22f1328bc81046398","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer overflow during MP4 atom processing\n\nA few sample table related FourCC values are handled by the\nsetSampleToChunkParams function. An integer overflow exists within this\nfunction. Validate that mNumSampleToChunkOffets will not cause an integer\noverflow.\n\nBug: 20139950\n\n(cherry picked from commit c24607c29c96f939aed9e33bfa702b1dd79da4b7)\n\nChange-Id: I49086952451b09a234d8b82669251ab9f1ef58d9","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/2434839bbd168469f80dd9a22f1328bc81046398"},{"sha":"5e751957ba692658b7f67eb03ae5ddb2cd3d970c","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer underflow in ESDS processing\n\nSeveral arithmetic operations within parseESDescriptor could underflow, leading\nto an out-of-bounds read operation. Ensure that subtractions from 'size' do not\ncause it to wrap around.\n\nBug: 20139950\n\n(cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)\n\nChange-Id: I377d21051e07ca654ea1f7037120429d3f71924a","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/5e751957ba692658b7f67eb03ae5ddb2cd3d970c"},{"sha":"51504928746edff6c94a1c498cf99c0a83bedaed","author":{"email":"a37b918d2e30a509a6a62aec92384cf4377987ae@google.com","name":"Marco Nelissen"},"message":"Add some sanity checks\n\nBug: 19400722\nChange-Id: Ib3afdf73fd4647eeea5721c61c8b72dbba0647f6","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/51504928746edff6c94a1c498cf99c0a83bedaed"},{"sha":"d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b","author":{"email":"8a149962704effdd4ef6827271fe942d7d775956@google.com","name":"Lajos Molnar"},"message":"Add AUtils::isInRange, and use it to detect malformed MPEG4 nal sizes\n\nBug: 19641538\nChange-Id: I5aae3f100846c125decc61eec7cd6563e3f33777","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b"},{"sha":"c82e31a7039a03dca7b37c65b7890ba5c1e18ced","author":{"email":"06267b1dc9b295ad6dc031d6ac2b113a1f6f99bd@google.com","name":"Chong Zhang"},"message":"HDCP: buffer over flow check -- DO NOT MERGE\n\nbug: 20222489\nChange-Id: I3a64a5999d68ea243d187f12ec7717b7f26d93a3\n(cherry picked from commit 532cd7b86a5fdc7b9a30a45d8ae2d16ef7660a72)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/c82e31a7039a03dca7b37c65b7890ba5c1e18ced"},{"sha":"086d84f45ab7b64d1a7ed7ac8ba5833664a6a5ab","author":{"email":"9c816bb17b802a3a905259535881a4d1d8ecb0fd@google.com","name":"Andy Hung"},"message":"IOMX: Add buffer range check to emptyBuffer\n\nBug: 20634516\nChange-Id: If351dbd573bb4aeb6968bfa33f6d407225bc752c\n(cherry picked from commit d971df0eb300356b3c995d533289216f43aa60de)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/086d84f45ab7b64d1a7ed7ac8ba5833664a6a5ab"},{"sha":"3cb1b6944e776863aea316e25fdc16d7f9962902","author":{"email":"9c816bb17b802a3a905259535881a4d1d8ecb0fd@google.com","name":"Andy Hung"},"message":"IOMX: Enable buffer ptr to buffer id translation for arm32\n\nBug: 20634516\nChange-Id: Iac9eac3cb251eccd9bbad5df7421a07edc21da0c\n(cherry picked from commit 2d6b6601743c3c6960c6511a2cb774ef902759f4)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/3cb1b6944e776863aea316e25fdc16d7f9962902"},{"sha":"f4a88c8ed4f8186b3d6e2852993e063fc33ff231","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer underflow in covr MPEG4 processing\n\nWhen the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an\ninteger underflow can occur. This causes an extraordinarily large value to\nbe passed to MetaData::setData, leading to a buffer overflow.\n\nBug: 20923261\nChange-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/f4a88c8ed4f8186b3d6e2852993e063fc33ff231"},{"sha":"463a6f807e187828442949d1924e143cf07778c6","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer overflow when handling MPEG4 tx3g atom\n\nWhen the sum of the 'size' and 'chunk_size' variables is larger than 2^32,\nan integer overflow occurs. Using the result value to allocate memory\nleads to an undersized buffer allocation and later a potentially\nexploitable heap corruption condition. Ensure that integer overflow does\nnot occur.\n\nBug: 20923261\nChange-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/463a6f807e187828442949d1924e143cf07778c6"},{"sha":"aeea52da00d210587fb3ed895de3d5f2e0264c88","author":{"email":"20deeb1c04e9ac926e776af1891f18fc65995bf0@google.com","name":"Eric Laurent"},"message":"audio effects: fix heap overflow\n\nCheck consistency of effect command reply sizes before\ncopying to reply address.\n\nAlso add null pointer check on reply size.\nAlso remove unused parameter warning.\n\nBug: 21953516.\nChange-Id: I4cf00c12eaed696af28f3b7613f7e36f47a160c4\n(cherry picked from commit 0f714a464d2425afe00d6450535e763131b40844)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/aeea52da00d210587fb3ed895de3d5f2e0264c88"},{"sha":"e846a5f367030f1c7916fb841953bdf82a763822","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent reading past the end of the buffer in 3GPP\n\nMetadata processed within the parse3GPPMetaData function may not be NUL\nterminated and thus calling setCString may read out of bounds. Ensure\nproper NUL termination, but take care not to interfere with other special\ncases (ie, albm).\n\nBug: 20923261\nChange-Id: Ie93b3038b534b4c4460571a68f4d734cff7ad324\n(cherry picked from commit 5cea0155cfc41f67e91343c342f44251c03fde3a)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/e846a5f367030f1c7916fb841953bdf82a763822"},{"sha":"2674a7218eaa3c87f2ee26d26da5b9170e10f859","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent integer overflow when processing covr MPEG4 atoms\n\nIf the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur\nand cause an undersized buffer to be allocated. The following processing\nthen overfills the resulting memory and creates a potentially exploitable\ncondition. Ensure that integer overflow does not occur.\n\nBug: 20923261\nChange-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/2674a7218eaa3c87f2ee26d26da5b9170e10f859"},{"sha":"f4f7e0c102819f039ebb1972b3dba1d3186bc1d1","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent integer underflow if size is below 6\n\nWhen processing 3GPP metadata, a subtraction operation may underflow and\nlead to a rather large linear byteswap operation in the subsequent\nframedata decoding code. Bound the 'size' value to prevent this from\noccurring.\n\nBug: 20923261\nChange-Id: I35dfbc8878c6b65cfe8b8adb7351a77ad4d604e5\n(cherry picked from commit 9458e715d391ee8fe455fc31f07ff35ce12e0531)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/f4f7e0c102819f039ebb1972b3dba1d3186bc1d1"},{"sha":"d776139c9d619a9d90325cea2704f413ded86c48","author":{"email":"83038b3400975ee6205f5756626cc027cbe411bb@google.com","name":"Jeff Tinker"},"message":"DO NOT MERGE: Lock drm plugin API calls globally, not per MediaDrm instance\n\nBug: 22414321\n\nChange-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc\nrelated-to-bug: 18394494\nrelated-to-bug: 19664283\n(cherry picked from commit 2fb561a6fe9bca79c50a81e90fc4bb4eb18af0be)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/d776139c9d619a9d90325cea2704f413ded86c48"},{"sha":"a5d9298a07d768552077cdbc5c1141e0e656485b","author":{"email":"5102321c73271f252c3a73f9d2f4b92eed376810@google.com","name":"Baligh Uddin"},"message":"Revert \"DO NOT MERGE: Lock drm plugin API calls globally, not per MediaDrm instance\"\n\nThis reverts commit d383176062362947455866af831d7db6ab085361.\n\nChange-Id: I0509f7eadb3a27c4cadbd3088cb57a588463f457","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/a5d9298a07d768552077cdbc5c1141e0e656485b"},{"sha":"304ef91624e12661e7e35c2c0c235da84a73e9c0","author":{"email":"a37b918d2e30a509a6a62aec92384cf4377987ae@google.com","name":"Marco Nelissen"},"message":"Guard against codecinfo overflow\n\nBug: 21296336\nChange-Id: I78be5141b3108142f12d7cb94839fa50f776d84a","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/304ef91624e12661e7e35c2c0c235da84a73e9c0"},{"sha":"6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968","author":{"email":"e7ef2d30577bd192d036a7f424ec6dd692d415f2@google.com","name":"Nick Kralevich"},"message":"MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX\n\nchunk_size is a uint64_t, so it can legitimately be bigger\nthan SIZE_MAX, which would cause the subtraction to underflow.\n\nhttps://code.google.com/p/android/issues/detail?id=182251\n\nBug: 23034759\nChange-Id: Ic1637fb26bf6edb0feb1bcf2876fd370db1ed547","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968"},{"sha":"e29953f3029d1e751c1e2ddbf351c8f8f9d81d44","author":{"email":"83038b3400975ee6205f5756626cc027cbe411bb@google.com","name":"Jeff Tinker"},"message":"DO NOT MERGE: Lock drm plugin API calls globally, not per MediaDrm instance\n\nBug: 22414321\n\nChange-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc\nrelated-to-bug: 18394494\nrelated-to-bug: 19664283\n(cherry picked from commit 2fb561a6fe9bca79c50a81e90fc4bb4eb18af0be)","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/e29953f3029d1e751c1e2ddbf351c8f8f9d81d44"},{"sha":"b2bb0bef9474411b3d217e5d50ad0ec17b16f4bf","author":{"email":"53ec54c629db0e1899183a46c65b03a7c50b6aac@gmail.com","name":"Yashar Ahmedizade"},"message":"Merge tag 'android-5.1.1_r15' of https://android.googlesource.com/platform/frameworks/av into HEAD\n\nAndroid 5.1.1 release 15","distinct":true,"url":"https://api.github.com/repos/ProjectDisco/android_frameworks_av/commits/b2bb0bef9474411b3d217e5d50ad0ec17b16f4bf"}]}