{"push_id":732328765,"size":8,"distinct_size":1,"ref":"refs/heads/cm-12.1_4412","head":"405e2480694601d992563f843e272ea2f398e2ba","before":"e00eb11517d1dcea37b32c55a6c24cf62ceb1808","commits":[{"sha":"7ff5505d36b1cfd8b03497e0fb5aa24b5b099e45","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent integer overflow when processing covr MPEG4 atoms\n\nIf the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur\nand cause an undersized buffer to be allocated. The following processing\nthen overfills the resulting memory and creates a potentially exploitable\ncondition. Ensure that integer overflow does not occur.\n\nBug: 20923261\nChange-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/7ff5505d36b1cfd8b03497e0fb5aa24b5b099e45"},{"sha":"b1f29294f1a5831eb52a81d3ee082a9475f6e879","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer underflow in covr MPEG4 processing\n\nWhen the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an\ninteger underflow can occur. This causes an extraordinarily large value to\nbe passed to MetaData::setData, leading to a buffer overflow.\n\nBug: 20923261\nChange-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/b1f29294f1a5831eb52a81d3ee082a9475f6e879"},{"sha":"889ae4ad7227c395615d03b24a1667caa162c75f","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Fix integer overflow when handling MPEG4 tx3g atom\n\nWhen the sum of the 'size' and 'chunk_size' variables is larger than 2^32,\nan integer overflow occurs. Using the result value to allocate memory\nleads to an undersized buffer allocation and later a potentially\nexploitable heap corruption condition. Ensure that integer overflow does\nnot occur.\n\nChange-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/889ae4ad7227c395615d03b24a1667caa162c75f"},{"sha":"9824bfd6eec1daa93cf76b6f4199602fe35f1d9d","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent integer underflow if size is below 6\n\nWhen processing 3GPP metadata, a subtraction operation may underflow and\nlead to a rather large linear byteswap operation in the subsequent\nframedata decoding code. Bound the 'size' value to prevent this from\noccurring.\n\nBug: 20923261\nChange-Id: I35dfbc8878c6b65cfe8b8adb7351a77ad4d604e5\n(cherry picked from commit 9458e715d391ee8fe455fc31f07ff35ce12e0531)","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/9824bfd6eec1daa93cf76b6f4199602fe35f1d9d"},{"sha":"57db9b42418b434751f609ac7e5539367e9f01a6","author":{"email":"e6174f28620a732b90d4d188e02b2df04615b0e8@qoop.org","name":"Joshua J. Drake"},"message":"Prevent reading past the end of the buffer in 3GPP\n\nMetadata processed within the parse3GPPMetaData function may not be NUL\nterminated and thus calling setCString may read out of bounds. Ensure\nproper NUL termination, but take care not to interfere with other special\ncases (ie, albm).\n\nBug: 20923261\nChange-Id: Ie93b3038b534b4c4460571a68f4d734cff7ad324\n(cherry picked from commit 5cea0155cfc41f67e91343c342f44251c03fde3a)","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/57db9b42418b434751f609ac7e5539367e9f01a6"},{"sha":"b55b927a6ae2eb67676e26fae45c7d81f585d7ac","author":{"email":"bc6501c174fe21162c67cfc51ecb38b9a4d035f0@gmail.com","name":"Ethan Chen"},"message":"stagefright: Remove deprecated FFMPEG config\n\nChange-Id: I1fcdb4eeba72e2420493b89ddd6fc718d170ced7","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/b55b927a6ae2eb67676e26fae45c7d81f585d7ac"},{"sha":"9d665ab1274d96e14a4a21ede87a0c5616b41b2b","author":{"email":"ad5ede63337b3f6ba0c8f4353e50bd01ded91d63@gmail.com","name":"Dan Pasanen"},"message":"camera: add ability for a device to specify MAX_CAMERAS\n\nChange-Id: I3db99ea4eff63aab3448efe7b2eb51366c658c03","distinct":false,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/9d665ab1274d96e14a4a21ede87a0c5616b41b2b"},{"sha":"405e2480694601d992563f843e272ea2f398e2ba","author":{"email":"465cf06cce96c75a908dcf32f8ceb6c17c3e72ed@gmail.com","name":"root"},"message":"Merge remote-tracking branch 'upstream/cm-12.1' into cm-12.1_4412\n\nConflicts:\n\tservices/camera/libcameraservice/CameraService.h","distinct":true,"url":"https://api.github.com/repos/voodik/android_frameworks_av/commits/405e2480694601d992563f843e272ea2f398e2ba"}]}