Skip to content

Commit 352b76d

Browse files
marconeandi34
marcone
authored and
andi34
committed
DO NOT MERGE Verify OMX buffer sizes prior to access
Bug: 27207275 Change-Id: I4412825d1ee233d993af0a67708bea54304ff62d
1 parent c8ccb66 commit 352b76d

File tree

19 files changed

+551
-67
lines changed

19 files changed

+551
-67
lines changed

‎media/libmedia/IOMX.cpp

Lines changed: 66 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
#define LOG_TAG "IOMX"
1919
#include <utils/Log.h>
2020

21+
#include <sys/mman.h>
22+
2123
#include <binder/IMemory.h>
2224
#include <binder/Parcel.h>
2325
#include <media/IOMX.h>
@@ -598,38 +600,70 @@ status_t BnOMX::onTransact(
598600

599601
size_t size = data.readInt32();
600602

601-
status_t err = NO_MEMORY;
602-
void *params = calloc(size, 1);
603-
if (params) {
604-
err = data.read(params, size);
605-
if (err != OK) {
606-
android_errorWriteLog(0x534e4554, "26914474");
603+
status_t err = NOT_ENOUGH_DATA;
604+
void *params = NULL;
605+
size_t pageSize = 0;
606+
size_t allocSize = 0;
607+
if (code != SET_INTERNAL_OPTION && size < 8) {
608+
// we expect the structure to contain at least the size and
609+
// version, 8 bytes total
610+
ALOGE("b/27207275 (%zu)", size);
611+
android_errorWriteLog(0x534e4554, "27207275");
612+
} else {
613+
err = NO_MEMORY;
614+
pageSize = (size_t) sysconf(_SC_PAGE_SIZE);
615+
if (size > SIZE_MAX - (pageSize * 2)) {
616+
ALOGE("requested param size too big");
607617
} else {
608-
switch (code) {
609-
case GET_PARAMETER:
610-
err = getParameter(node, index, params, size);
611-
break;
612-
case SET_PARAMETER:
613-
err = setParameter(node, index, params, size);
614-
break;
615-
case GET_CONFIG:
616-
err = getConfig(node, index, params, size);
617-
break;
618-
case SET_CONFIG:
619-
err = setConfig(node, index, params, size);
620-
break;
621-
case SET_INTERNAL_OPTION:
622-
{
623-
InternalOptionType type =
624-
(InternalOptionType)data.readInt32();
625-
626-
err = setInternalOption(node, index, type, params, size);
627-
break;
618+
allocSize = (size + pageSize * 2) & ~(pageSize - 1);
619+
params = mmap(NULL, allocSize, PROT_READ | PROT_WRITE,
620+
MAP_PRIVATE | MAP_ANONYMOUS, -1 /* fd */, 0 /* offset */);
621+
}
622+
if (params != MAP_FAILED) {
623+
err = data.read(params, size);
624+
if (err != OK) {
625+
android_errorWriteLog(0x534e4554, "26914474");
626+
} else {
627+
err = NOT_ENOUGH_DATA;
628+
OMX_U32 declaredSize = *(OMX_U32*)params;
629+
if (code != SET_INTERNAL_OPTION && declaredSize > size) {
630+
// the buffer says it's bigger than it actually is
631+
ALOGE("b/27207275 (%u/%zu)", declaredSize, size);
632+
android_errorWriteLog(0x534e4554, "27207275");
633+
} else {
634+
// mark the last page as inaccessible, to avoid exploitation
635+
// of codecs that access past the end of the allocation because
636+
// they didn't check the size
637+
mprotect((char*)params + allocSize - pageSize, pageSize, PROT_NONE);
638+
switch (code) {
639+
case GET_PARAMETER:
640+
err = getParameter(node, index, params, size);
641+
break;
642+
case SET_PARAMETER:
643+
err = setParameter(node, index, params, size);
644+
break;
645+
case GET_CONFIG:
646+
err = getConfig(node, index, params, size);
647+
break;
648+
case SET_CONFIG:
649+
err = setConfig(node, index, params, size);
650+
break;
651+
case SET_INTERNAL_OPTION:
652+
{
653+
InternalOptionType type =
654+
(InternalOptionType)data.readInt32();
655+
656+
err = setInternalOption(node, index, type, params, size);
657+
break;
658+
}
659+
660+
default:
661+
TRESPASS();
662+
}
628663
}
629-
630-
default:
631-
TRESPASS();
632664
}
665+
} else {
666+
ALOGE("couldn't map: %s", strerror(errno));
633667
}
634668
}
635669

@@ -639,7 +673,9 @@ status_t BnOMX::onTransact(
639673
reply->write(params, size);
640674
}
641675

642-
free(params);
676+
if (params) {
677+
munmap(params, allocSize);
678+
}
643679
params = NULL;
644680

645681
return NO_ERROR;

‎media/libstagefright/codecs/aacdec/SoftAAC2.cpp

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,10 @@ OMX_ERRORTYPE SoftAAC2::internalGetParameter(
162162
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
163163
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
164164

165+
if (!isValidOMXParam(aacParams)) {
166+
return OMX_ErrorBadParameter;
167+
}
168+
165169
if (aacParams->nPortIndex != 0) {
166170
return OMX_ErrorUndefined;
167171
}
@@ -197,6 +201,10 @@ OMX_ERRORTYPE SoftAAC2::internalGetParameter(
197201
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
198202
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
199203

204+
if (!isValidOMXParam(pcmParams)) {
205+
return OMX_ErrorBadParameter;
206+
}
207+
200208
if (pcmParams->nPortIndex != 1) {
201209
return OMX_ErrorUndefined;
202210
}
@@ -237,6 +245,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
237245
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
238246
(const OMX_PARAM_COMPONENTROLETYPE *)params;
239247

248+
if (!isValidOMXParam(roleParams)) {
249+
return OMX_ErrorBadParameter;
250+
}
251+
240252
if (strncmp((const char *)roleParams->cRole,
241253
"audio_decoder.aac",
242254
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -251,6 +263,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
251263
const OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
252264
(const OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
253265

266+
if (!isValidOMXParam(aacParams)) {
267+
return OMX_ErrorBadParameter;
268+
}
269+
254270
if (aacParams->nPortIndex != 0) {
255271
return OMX_ErrorUndefined;
256272
}
@@ -272,6 +288,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
272288
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
273289
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
274290

291+
if (!isValidOMXParam(pcmParams)) {
292+
return OMX_ErrorBadParameter;
293+
}
294+
275295
if (pcmParams->nPortIndex != 1) {
276296
return OMX_ErrorUndefined;
277297
}

‎media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
154154
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
155155
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
156156

157+
if (!isValidOMXParam(formatParams)) {
158+
return OMX_ErrorBadParameter;
159+
}
160+
157161
if (formatParams->nPortIndex > 1) {
158162
return OMX_ErrorUndefined;
159163
}
@@ -174,6 +178,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
174178
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
175179
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
176180

181+
if (!isValidOMXParam(aacParams)) {
182+
return OMX_ErrorBadParameter;
183+
}
184+
177185
if (aacParams->nPortIndex != 1) {
178186
return OMX_ErrorUndefined;
179187
}
@@ -198,6 +206,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
198206
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
199207
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
200208

209+
if (!isValidOMXParam(pcmParams)) {
210+
return OMX_ErrorBadParameter;
211+
}
212+
201213
if (pcmParams->nPortIndex != 0) {
202214
return OMX_ErrorUndefined;
203215
}
@@ -229,6 +241,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
229241
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
230242
(const OMX_PARAM_COMPONENTROLETYPE *)params;
231243

244+
if (!isValidOMXParam(roleParams)) {
245+
return OMX_ErrorBadParameter;
246+
}
247+
232248
if (strncmp((const char *)roleParams->cRole,
233249
"audio_encoder.aac",
234250
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -243,6 +259,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
243259
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
244260
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
245261

262+
if (!isValidOMXParam(formatParams)) {
263+
return OMX_ErrorBadParameter;
264+
}
265+
246266
if (formatParams->nPortIndex > 1) {
247267
return OMX_ErrorUndefined;
248268
}
@@ -266,6 +286,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
266286
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
267287
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
268288

289+
if (!isValidOMXParam(aacParams)) {
290+
return OMX_ErrorBadParameter;
291+
}
292+
269293
if (aacParams->nPortIndex != 1) {
270294
return OMX_ErrorUndefined;
271295
}
@@ -286,6 +310,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
286310
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
287311
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
288312

313+
if (!isValidOMXParam(pcmParams)) {
314+
return OMX_ErrorBadParameter;
315+
}
316+
289317
if (pcmParams->nPortIndex != 0) {
290318
return OMX_ErrorUndefined;
291319
}

‎media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
120120
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
121121
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
122122

123+
if (!isValidOMXParam(formatParams)) {
124+
return OMX_ErrorBadParameter;
125+
}
126+
123127
if (formatParams->nPortIndex > 1) {
124128
return OMX_ErrorUndefined;
125129
}
@@ -140,6 +144,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
140144
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
141145
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
142146

147+
if (!isValidOMXParam(aacParams)) {
148+
return OMX_ErrorBadParameter;
149+
}
150+
143151
if (aacParams->nPortIndex != 1) {
144152
return OMX_ErrorUndefined;
145153
}
@@ -164,6 +172,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
164172
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
165173
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
166174

175+
if (!isValidOMXParam(pcmParams)) {
176+
return OMX_ErrorBadParameter;
177+
}
178+
167179
if (pcmParams->nPortIndex != 0) {
168180
return OMX_ErrorUndefined;
169181
}
@@ -195,6 +207,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
195207
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
196208
(const OMX_PARAM_COMPONENTROLETYPE *)params;
197209

210+
if (!isValidOMXParam(roleParams)) {
211+
return OMX_ErrorBadParameter;
212+
}
213+
198214
if (strncmp((const char *)roleParams->cRole,
199215
"audio_encoder.aac",
200216
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -209,6 +225,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
209225
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
210226
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
211227

228+
if (!isValidOMXParam(formatParams)) {
229+
return OMX_ErrorBadParameter;
230+
}
231+
212232
if (formatParams->nPortIndex > 1) {
213233
return OMX_ErrorUndefined;
214234
}
@@ -232,6 +252,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
232252
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
233253
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
234254

255+
if (!isValidOMXParam(aacParams)) {
256+
return OMX_ErrorBadParameter;
257+
}
258+
235259
if (aacParams->nPortIndex != 1) {
236260
return OMX_ErrorUndefined;
237261
}
@@ -255,6 +279,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
255279
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
256280
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
257281

282+
if (!isValidOMXParam(pcmParams)) {
283+
return OMX_ErrorBadParameter;
284+
}
285+
258286
if (pcmParams->nPortIndex != 0) {
259287
return OMX_ErrorUndefined;
260288
}

‎media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,10 @@ OMX_ERRORTYPE SoftAMR::internalGetParameter(
148148
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
149149
(OMX_AUDIO_PARAM_AMRTYPE *)params;
150150

151+
if (!isValidOMXParam(amrParams)) {
152+
return OMX_ErrorBadParameter;
153+
}
154+
151155
if (amrParams->nPortIndex != 0) {
152156
return OMX_ErrorUndefined;
153157
}
@@ -174,6 +178,10 @@ OMX_ERRORTYPE SoftAMR::internalGetParameter(
174178
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
175179
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
176180

181+
if (!isValidOMXParam(pcmParams)) {
182+
return OMX_ErrorBadParameter;
183+
}
184+
177185
if (pcmParams->nPortIndex != 1) {
178186
return OMX_ErrorUndefined;
179187
}
@@ -207,6 +215,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
207215
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
208216
(const OMX_PARAM_COMPONENTROLETYPE *)params;
209217

218+
if (!isValidOMXParam(roleParams)) {
219+
return OMX_ErrorBadParameter;
220+
}
221+
210222
if (mMode == MODE_NARROW) {
211223
if (strncmp((const char *)roleParams->cRole,
212224
"audio_decoder.amrnb",
@@ -229,6 +241,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
229241
const OMX_AUDIO_PARAM_AMRTYPE *aacParams =
230242
(const OMX_AUDIO_PARAM_AMRTYPE *)params;
231243

244+
if (!isValidOMXParam(aacParams)) {
245+
return OMX_ErrorBadParameter;
246+
}
247+
232248
if (aacParams->nPortIndex != 0) {
233249
return OMX_ErrorUndefined;
234250
}
@@ -241,6 +257,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
241257
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
242258
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
243259

260+
if (!isValidOMXParam(pcmParams)) {
261+
return OMX_ErrorBadParameter;
262+
}
263+
244264
if (pcmParams->nPortIndex != 1) {
245265
return OMX_ErrorUndefined;
246266
}

0 commit comments

Comments
 (0)