{"push_id":759140740,"size":10,"distinct_size":10,"ref":"refs/heads/lp","head":"4e00796ca5a25cbd973b00b3aa264b92f7c65ade","before":"b25559ef9a15d8b7b944fda213e83084ef045603","commits":[{"sha":"302ee2b26726c9b2a25105ca2ead614a7cb77cbf","author":{"email":"a37b918d2e30a509a6a62aec92384cf4377987ae@google.com","name":"Marco Nelissen"},"message":"Guard against codecinfo overflow\n\nBug: 21296336\nChange-Id: I78be5141b3108142f12d7cb94839fa50f776d84a\nTicket: CYNGNOS-676","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/302ee2b26726c9b2a25105ca2ead614a7cb77cbf"},{"sha":"59a2c618dde4c216b2efed6233c72ac1336e085c","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"MPEG4Extractor: still more NULL dereference fixes\n\nWhen processing various FourCC values within MP4 media, mLastTrack is accessed\nwithout first ensuring that a track has been encoutered. Check for NULL and\nbail out instead of crashing.\n\nBug: 20139950\nChange-Id: Ie16687024d17348f576a0e13bd60bd4d6898de91","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/59a2c618dde4c216b2efed6233c72ac1336e085c"},{"sha":"cbe51bda9bde3e7a3005eb1d509340340c4c7349","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix null-pointer-dereferences accessing the SampleTable\n\nWhile processing various sample table related FourCC values, methods are called\non a NULL mLastTrack or sampleTable object. This leads to undefined behavior\nwhich typically results in a crash (denial of service condition).\n\nChange-Id: I39a894f8709d9937a0456ae5b3a201f7ecf12ed0\n\nSigned-off-by: zephiK <zephik@gmail.com>","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/cbe51bda9bde3e7a3005eb1d509340340c4c7349"},{"sha":"8a4dd43f5d7881f9970b2bc547e200acfe8abf7c","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix multiple division-by-zero conditions in MPEG4 parsing\n\nSeveral situations arise processing MP4 atoms that lead to undefined behavior\nwhen dividing by zero. Typically this results in a crash (denial of service\ncondition).\n\nNOTE: In most cases we simply avoid the division, leaving kKeyDuration unset.\nIt may be more desirable to bail out, as we do in the parseSegmentIndex case.\n\nChange-Id: Iab0118934b49eabd0b44be8408160d7f122c28df\n\nSigned-off-by: zephiK <zephik@gmail.com>","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/8a4dd43f5d7881f9970b2bc547e200acfe8abf7c"},{"sha":"f3eb9fae802468cecf4b4cf8ce65b0b5157e7baf","author":{"email":"e7ef2d30577bd192d036a7f424ec6dd692d415f2@google.com","name":"Nick Kralevich"},"message":"MPEG4Extractor.cpp: Add check for size == SIZE_MAX\n\nIf size == SIZE_MAX, the line:\n\n  uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];\n\nends up allocating zero bytes, which is obviously incorrect.\n\n(cherrypicked from commit b2d33aee5122c91a59c2a676c0b89ad340232450)\n\nChange-Id: I7d44a66b67c590041572e25d1fbd1de94401a77f","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/f3eb9fae802468cecf4b4cf8ce65b0b5157e7baf"},{"sha":"b8ffe9407c003c06dceaa32482483565e072e555","author":{"email":"e7ef2d30577bd192d036a7f424ec6dd692d415f2@google.com","name":"Nick Kralevich"},"message":"MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX\n\nchunk_size is a uint64_t, so it can legitimately be bigger\nthan SIZE_MAX, which would cause the subtraction to underflow.\n\nhttps://code.google.com/p/android/issues/detail?id=182251\n\nBug: 23034759\nChange-Id: Ic1637fb26bf6edb0feb1bcf2876fd370db1ed547","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/b8ffe9407c003c06dceaa32482483565e072e555"},{"sha":"400c93d43e21d322e58a4c2c15c1d5a968083ca1","author":{"email":"901052e97499deb567b9ea16af7551e78fd1b42f@google.com","name":"Wei Jia"},"message":"SampleTable: fix integer overflow checks.\n\nBug: 20139950\nChange-Id: I6f4e3d4c734872074475d9346ed692a4baf77d79","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/400c93d43e21d322e58a4c2c15c1d5a968083ca1"},{"sha":"f2197e63a04cfdb52cfd204a48b4374d58679c99","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Detect allocation failures and bail gracefully\n\nDuring the processing of several sample table related MP4 atoms, allocation\nsizes could be large enough cause a std::bad_alloc exception to be raised. This\ntypically causes a crash (denial of service condition). Use std::nothrow to\ncatch allocation failures and return gracefully.\n\nBug: 20139950\nChange-Id: I03d3f01b24e5fe3fa38985914bcfa694ea3dc09e","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/f2197e63a04cfdb52cfd204a48b4374d58679c99"},{"sha":"6b31a8f3f9389a8b31a228fabc2cfbc6eaa0ed86","author":{"email":"fa08c03027095591d71e44938719f055686185ed@codeaurora.org","name":"Shivaprasad Hongal"},"message":"libstagefright: Fix crash in convertMetaDataToMessage\n\n- The ABuffer used for the Message has a preset value of 1024, if\n  flattening the meta data exceeds this value, a check fails hence\n  the crash.\n- This change creates a new ABuffer if the buffer size would exceed\n  the buffer capacity.\n\nCRs-Fixed: 857850\n\nChange-Id: Iaa7374a4734a49db257a3f102a88412fde672260","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/6b31a8f3f9389a8b31a228fabc2cfbc6eaa0ed86"},{"sha":"4e00796ca5a25cbd973b00b3aa264b92f7c65ade","author":{"email":"4e97556b743cd796f5904082ec19b5cf2f4f18e4@gmail.com","name":"Muhammed Nazim"},"message":"Forward Port: Add Camera sound toggle [3/3]\n\nChange-Id: I3ac951967f8403252c7f944fcbde927ee75608e6","distinct":true,"url":"https://api.github.com/repos/PureNexus/android_frameworks_av/commits/4e00796ca5a25cbd973b00b3aa264b92f7c65ade"}]}