Tom Taylor
f9b9dc3d2f
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec am: 22bbfd7360 am: 7a6b99a4a4 am: 6ea30b87b1 am: a072033ce4 am: 93d52cb5e2
...
am: cbed68f73b
2017-07-12 19:15:11 +00:00
Tom Taylor
cbed68f73b
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec am: 22bbfd7360 am: 7a6b99a4a4 am: 6ea30b87b1 am: a072033ce4
...
am: 93d52cb5e2
2017-07-12 19:12:40 +00:00
Tom Taylor
93d52cb5e2
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec am: 22bbfd7360 am: 7a6b99a4a4 am: 6ea30b87b1
...
am: a072033ce4
2017-07-12 19:11:39 +00:00
Tom Taylor
a072033ce4
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec am: 22bbfd7360 am: 7a6b99a4a4
...
am: 6ea30b87b1
2017-07-12 19:09:10 +00:00
Tom Taylor
6ea30b87b1
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec am: 22bbfd7360
...
am: 7a6b99a4a4
2017-07-12 19:07:09 +00:00
Tom Taylor
7a6b99a4a4
37742976 - Catch bad gifs am: e0f247e399 am: 7c28ca34ec
...
am: 22bbfd7360
2017-07-12 19:06:10 +00:00
Tom Taylor
22bbfd7360
37742976 - Catch bad gifs am: e0f247e399
...
am: 7c28ca34ec
2017-07-12 19:02:38 +00:00
Tom Taylor
7c28ca34ec
37742976 - Catch bad gifs
...
am: e0f247e399
2017-07-12 19:01:08 +00:00
Tom Taylor
e0f247e399
37742976 - Catch bad gifs
...
* A security researcher crafted a gif that would cause the Android
Bitmap code to throw an NPE. That would cause messaging to crash when
decoding the NPE. Catch the NPE.
Test: manually tested the "crash.gif" attached to the bug. Stepped
through the debugger to verify we're catching the NPE and logging
the attempt. Verified normal gifs still work.
Bug: 37742976
Change-Id: Iab814d5b0b514bed0cecddd9a76f1fc095f90892
(cherry picked from commit 3671fd94ae
2017-06-23 16:48:57 -07:00
Matt Sarett
ebe4ce865f
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec am: 93facf6314 am: cc1dbfc497 -s ours am: 7fb08c55f5 am: 172aeda52b am: d7b191a016
...
am: ffa6f9ac89
2017-03-15 17:10:03 +00:00
Matt Sarett
ffa6f9ac89
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec am: 93facf6314 am: cc1dbfc497 -s ours am: 7fb08c55f5 am: 172aeda52b
...
am: d7b191a016
2017-03-15 17:05:02 +00:00
Matt Sarett
d7b191a016
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec am: 93facf6314 am: cc1dbfc497 -s ours am: 7fb08c55f5
...
am: 172aeda52b
2017-03-15 16:59:32 +00:00
Matt Sarett
172aeda52b
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec am: 93facf6314 am: cc1dbfc497 -s ours
...
am: 7fb08c55f5
2017-03-15 16:54:02 +00:00
Matt Sarett
7fb08c55f5
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec am: 93facf6314
...
am: cc1dbfc497
2017-03-15 16:49:25 +00:00
Matt Sarett
cc1dbfc497
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e am: 0cf3a7d3ec
...
am: 93facf6314
2017-03-15 16:45:22 +00:00
Matt Sarett
93facf6314
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE am: 60519c717e
...
am: 0cf3a7d3ec
2017-03-15 16:39:46 +00:00
Matt Sarett
0cf3a7d3ec
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE
...
am: 60519c717e
2017-03-15 16:34:47 +00:00
Matt Sarett
60519c717e
Update callers *GifCloseFile for new GIFLIB DO NOT MERGE
...
Bug:34697653
Test: build; existing CTS tests
Original commit message:
Fix build breakage caused by updating giflib
Change-Id: I085379470620ec4db13f8baf7a9eb069747270b7
2017-03-15 10:15:32 -04:00
Tom Taylor
8495e582a1
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb am: 71d4913462 am: 82fa311e9a am: cc649e4e1e am: 657379f51c am: fb324f89bf
...
am: eece1bd759
2017-01-17 19:59:54 +00:00
Tom Taylor
eece1bd759
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb am: 71d4913462 am: 82fa311e9a am: cc649e4e1e am: 657379f51c
...
am: fb324f89bf
2017-01-17 19:57:24 +00:00
Tom Taylor
fb324f89bf
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb am: 71d4913462 am: 82fa311e9a am: cc649e4e1e
...
am: 657379f51c
2017-01-17 19:55:43 +00:00
Tom Taylor
657379f51c
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb am: 71d4913462 am: 82fa311e9a
...
am: cc649e4e1e
2017-01-17 19:53:24 +00:00
Tom Taylor
cc649e4e1e
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb am: 71d4913462
...
am: 82fa311e9a
2017-01-17 19:51:36 +00:00
Tom Taylor
82fa311e9a
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a am: 9f00add2fb
...
am: 71d4913462
2017-01-17 19:49:23 +00:00
Tom Taylor
71d4913462
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex] am: 6f763fef7a
...
am: 9f00add2fb
2017-01-17 19:46:53 +00:00
Tom Taylor
9f00add2fb
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex]
...
am: 6f763fef7a
2017-01-17 19:44:53 +00:00
Tom Taylor
6f763fef7a
32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so
...
in colorMap->Colors[colorIndex]
* No range checking was done on a color index. Add range
checking and bail if the color index is out of range.
Test: tested sending a large gif that would invoke the GifTranscoder library
to make the gif smaller.
Bug: 32764144
Change-Id: I44f36274ec333ae1960fa8fc96b2dbde35fbaa66
2017-01-13 14:47:35 -08:00
Tom Taylor
f07dfd0a19
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779 am: cefccea7b4 am: c708e8fb35 am: 2917015529 am: 508f541438 am: 728c4943e9
...
am: 0d9e6a3cf5
2017-01-06 18:07:43 +00:00
Tom Taylor
0d9e6a3cf5
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779 am: cefccea7b4 am: c708e8fb35 am: 2917015529 am: 508f541438
...
am: 728c4943e9
2017-01-06 18:03:43 +00:00
Tom Taylor
728c4943e9
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779 am: cefccea7b4 am: c708e8fb35 am: 2917015529
...
am: 508f541438
2017-01-06 17:59:14 +00:00
Tom Taylor
508f541438
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779 am: cefccea7b4 am: c708e8fb35
...
am: 2917015529
2017-01-06 17:56:08 +00:00
Tom Taylor
2917015529
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779 am: cefccea7b4
...
am: c708e8fb35
2017-01-06 17:51:59 +00:00
Tom Taylor
c708e8fb35
33388925 Mismatched new vs delete in framesequence library am: 837474a376 am: b44b56b779
...
am: cefccea7b4
2017-01-06 17:48:29 +00:00
Tom Taylor
cefccea7b4
33388925 Mismatched new vs delete in framesequence library am: 837474a376
...
am: b44b56b779
2017-01-06 17:45:00 +00:00
Tom Taylor
b44b56b779
33388925 Mismatched new vs delete in framesequence library
...
am: 837474a376
2017-01-06 17:41:33 +00:00
Tom Taylor
837474a376
33388925 Mismatched new vs delete in framesequence library
...
* The array allocations neglected to include [] so delete, instead
of delete [] would get called.
* Test
Manual
- tested sending a large gif that would invoke the GifTranscoder library
to make the gif smaller.
Bug: 33388925
Change-Id: I1e200e470d66ae615ffe9340ff9c049eaa73f63c
2017-01-04 09:42:37 -08:00
Tom Taylor
904b5cbec5
Merge "32161610 Security Vulnerability - Information disclosure vulnerability in AOSP Messaging" into mnc-dev am: 3f6e2e2b07 am: 091876853c am: 5cfdea9be6 am: ced2069d1c am: 518c9798eb am: 8166028e03 am: 28c5e61eb5
...
am: 4d1366300e
2016-12-07 02:58:04 +00:00
Tom Taylor
0c37f58fa0
resolve merge conflicts of eafd58a to nyc-dev am: a43c5c5f18 am: 4d220d4777 am: 47feeee8ee
...
am: 838049884f
2016-12-07 02:57:54 +00:00
Tom Taylor
4d1366300e
Merge "32161610 Security Vulnerability - Information disclosure vulnerability in AOSP Messaging" into mnc-dev am: 3f6e2e2b07 am: 091876853c am: 5cfdea9be6 am: ced2069d1c am: 518c9798eb am: 8166028e03
...
am: 28c5e61eb5
2016-12-07 02:54:04 +00:00
Tom Taylor
838049884f
resolve merge conflicts of eafd58a to nyc-dev am: a43c5c5f18 am: 4d220d4777
...
am: 47feeee8ee
2016-12-07 02:53:54 +00:00
Tom Taylor
28c5e61eb5
Merge "32161610 Security Vulnerability - Information disclosure vulnerability in AOSP Messaging" into mnc-dev am: 3f6e2e2b07 am: 091876853c am: 5cfdea9be6 am: ced2069d1c am: 518c9798eb
...
am: 8166028e03
2016-12-07 02:49:34 +00:00
Tom Taylor
47feeee8ee
resolve merge conflicts of eafd58a to nyc-dev am: a43c5c5f18
...
am: 4d220d4777
2016-12-07 02:49:24 +00:00
Tom Taylor
8166028e03
Merge "32161610 Security Vulnerability - Information disclosure vulnerability in AOSP Messaging" into mnc-dev am: 3f6e2e2b07 am: 091876853c am: 5cfdea9be6 am: ced2069d1c
...
am: 518c9798eb
2016-12-07 02:46:00 +00:00
Tom Taylor
4d220d4777
resolve merge conflicts of eafd58a to nyc-dev
...
am: a43c5c5f18
2016-12-07 02:45:53 +00:00
Tom Taylor
518c9798eb
Merge "32161610 Security Vulnerability - Information disclosure vulnerability in AOSP Messaging" into mnc-dev am: 3f6e2e2b07 am: 091876853c am: 5cfdea9be6
...
am: ced2069d1c
2016-12-07 02:41:54 +00:00
Tom Taylor
a43c5c5f18
resolve merge conflicts of eafd58a to nyc-dev
...
Change-Id: I58151ca0c248dd4b84c78c8e7ca73d5a80bbd962
2016-12-06 16:26:14 -08:00
Tom Taylor
a9bec8503b
32807795 Security Vulnerability - AOSP Messaging App: thirdparty can attach private files from "/data/data/com.android.messaging/" directory to the messaging app. am: a2aa53f83a am: 90bf70396d am: 305a004e19 am: 2397f2fbef am: 313284eee7 am: 4dfcff98da am: 615f6d0b17
...
am: 49b092f602
2016-12-06 22:39:38 +00:00
Tom Taylor
49b092f602
32807795 Security Vulnerability - AOSP Messaging App: thirdparty can attach private files from "/data/data/com.android.messaging/" directory to the messaging app. am: a2aa53f83a am: 90bf70396d am: 305a004e19 am: 2397f2fbef am: 313284eee7 am: 4dfcff98da
...
am: 615f6d0b17
2016-12-06 22:36:08 +00:00
Tom Taylor
615f6d0b17
32807795 Security Vulnerability - AOSP Messaging App: thirdparty can attach private files from "/data/data/com.android.messaging/" directory to the messaging app. am: a2aa53f83a am: 90bf70396d am: 305a004e19 am: 2397f2fbef am: 313284eee7
...
am: 4dfcff98da
2016-12-06 22:31:37 +00:00
Tom Taylor
4dfcff98da
32807795 Security Vulnerability - AOSP Messaging App: thirdparty can attach private files from "/data/data/com.android.messaging/" directory to the messaging app. am: a2aa53f83a am: 90bf70396d am: 305a004e19 am: 2397f2fbef
...
am: 313284eee7
2016-12-06 22:27:37 +00:00
Tom Taylor
Matt Sarett