Age | Commit message (Collapse) | Author |
|
Change-Id: I93ca5d0d5961777533ecb3437672efd2ae8348b2
|
|
ours am: 704e28140c -s ours
am skip reason: Change-Id I71d7859864524a65cc928f4555dd4dc5cd7a9925 with SHA-1 1cf29eb4cf is in history
Original change: undetermined
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I4e241f094d35ca121a1b34cf05e27349c796b36d
|
|
am skip reason: Change-Id I71d7859864524a65cc928f4555dd4dc5cd7a9925 with SHA-1 1cf29eb4cf is in history
Original change: undetermined
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I15f4b932c4ac8b77a5ffb488baaf62a5de0f616c
|
|
Bug: 180401296
Merged-In: I71d7859864524a65cc928f4555dd4dc5cd7a9925
Change-Id: Ic391159e8dd8883710b1ff45cb073a00bacf0c74
|
|
Change-Id: I5e03edaa4279807acf6e1d63247189e0a85c41aa
|
|
db06ddaca6 am: 1e39c29b88
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1588663
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Ib4ebe02ddfe6a60a9237f29797ad7a0519e0ada1
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1588663
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Idba69c66955aae4c6a8ba9380bc43b972862f08e
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1588663
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I5ce4bb83b89f2901fee5652c6ea0897dadd14ba2
|
|
Added SPDX-license-identifier-BSD to:
Android.bp
Bug: 68860345
Bug: 151177513
Bug: 151953481
Test: m all
Exempt-From-Owner-Approval: janitorial work
Change-Id: I9016057dcb811ceea4b0cbb71a6febd16646be64
|
|
Change-Id: I4b3383649faa44bf90eed6ad2d7054aec6f2186a
|
|
encoding."" am: 2a2e619c0e am: 7d6341ae53 am: 1cf29eb4cf
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1528747
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I14c087a08d2b4697937ffa9b952ac85bd73e8e37
|
|
encoding."" am: 2a2e619c0e am: 7d6341ae53
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1528747
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I71d7859864524a65cc928f4555dd4dc5cd7a9925
|
|
encoding."" am: 2a2e619c0e
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1528747
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I73cd5dd6b4c64cebc3462756d5f5791ac63a54de
|
|
encoding.""
|
|
This reverts commit f2b9cbe96de02a2150cc3a1a24d2c1f3c95f6091.
Reason for revert: Build breakage.
Bug: 175637287
Change-Id: Iee3769f81fb3e21c16f685ad2f6cbb0ee4465b2f
|
|
Change-Id: I5f83e3615b288c46e2e5f992d2107b1a97a1d02a
|
|
encoding." am: 5fdfb920c6 am: 47d91ab99b am: 8fb71d456f
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506861
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Ib47a0cda6aca7c485571d3ae3a24e0a8a3ec5ec5
|
|
encoding." am: 5fdfb920c6 am: 47d91ab99b
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506861
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Id95a7ffe334a7fb8231e87e150388bb63e3d2c76
|
|
encoding." am: 5fdfb920c6
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506861
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I9cbef0ed8bfd9332c3ab2bbba7675a6cd53500bf
|
|
|
|
Change-Id: I8c8240015f90dfc3ce0ac422375694d4ee87e2d1
|
|
0428151ec8 am: 1a5a14f484 am: c52e98a9c1
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510523
Change-Id: I3b514d920f315234a6ca0b8f4b3a5009dd0b9b51
|
|
0428151ec8 am: 1a5a14f484
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510523
Change-Id: I0eea8902b3e0126ebd8c817d2a924f637442c0bf
|
|
0428151ec8
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510523
Change-Id: I9dc4946c9db10c5b5e7ea68df77259d60a443607
|
|
|
|
Change-Id: I3bb3326d7c76c4bb9e5b52897a531b4ca5c77404
|
|
am: 28091ebfbf
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506860
Change-Id: I6861c7f796d31a8bf7414d96eb97bef41581a441
|
|
am: cfbe5d810d am: 31b542f9cd
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510509
Change-Id: I6dcbc3d870db53ec42d7be04e3fb7c57bb96a6f5
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506860
Change-Id: I7159b359e5adbed691949513b66b91137764c0d8
|
|
am: cfbe5d810d
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510509
Change-Id: I5df4f5d63c0620993da75f6555531be8722a0d97
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1506860
Change-Id: Ia2d568e1a47bb5f74a3f439ac23c80e5f2b9c1f8
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1510509
Change-Id: I61a08529eba369b6248d86c9d3512e2856559599
|
|
Test: ${ANDROID_HOST_OUT}/fuzz/$(get_build_var HOST_ARCH)/libwebm_mkvmuxer_fuzzer_one_video_audio_track/libwebm_mkvmuxer_fuzzer_one_video_audio_track
Test: ${ANDROID_HOST_OUT}/fuzz/$(get_build_var HOST_ARCH)/libwebm_mkvmuxer_fuzzer_one_video_track/libwebm_mkvmuxer_fuzzer_one_video_track
Change-Id: I62b828e4c83d144f9551262207775913962efac6
|
|
Test: make
Change-Id: Ic4316c2f1a550a3f24326e5efe725e4597b7d3e3
|
|
|
|
Test: m -j libwebm_mkvmuxer
Change-Id: I4b48ebcd97c9b0f89a0f48d213465db93476020e
|
|
The problem in WriteFramesAll manifests as a null pointer dereference,
while the problem in WriteFramesLessThan manifests as a use-after-free.
When multiple audio frames are queued in the Segment and a call to
WriteFramesAll or WriteFramesLessThan fails partway through, there
may be null frames left in the Segment frame queue.
This is fixed by dropping the invalid frames and continuing so that the
queue is in a good state after a call, even if it fails.
Found through fuzzing mkvmuxer.
Minimal reproduction case for issue with WriteFramesAll.
```
#include <stdint.h>
#include "mkvmuxer/mkvmuxer.h"
#include "mkvmuxer/mkvwriter.h"
int main() {
mkvmuxer::MkvWriter writer;
writer.Open("file.mkv");
mkvmuxer::Segment segment;
segment.Init(&writer);
uint64_t video_track = segment.AddVideoTrack(1, 1, 0);
uint64_t audio_track = segment.AddAudioTrack(1, 1, 0);
uint8_t data[] = {0};
segment.AddFrame(data, 1, audio_track, 395136991333ULL, false);
segment.AddFrame(data, 1, audio_track, 18374686479674129407ULL, false);
segment.AddFrame(data, 1, video_track, 18446462628926195463ULL, false);
segment.Finalize();
}
```
The second audio frame has an invalid timestamp that is only caught in
WriteFrame from mkvmuxerutil.cc , causing WriteFramesAll to fail on
writing the second audio frame when the first video frame forces a new
cluster.
WriteFramesLessThan has a similar pattern, where failing partway through
a write can leave the Segment in a bad state.
Bug: b/174070314
Test: clang++ *.cc repro.cpp -I.. -o repro -fsanitize=address -g && ./repro
Change-Id: I05c707477e454752776c7571aff9f24f22195d55
(cherry picked from commit 97f8074dc9cc5ca0263325c16340ff0f4fcfc212)
|
|
PiperOrigin-RevId: 314246132
Change-Id: I92a5a7e46cfde7c7691f90856bd962b606529036
|
|
The problem in WriteFramesAll manifests as a null pointer dereference,
while the problem in WriteFramesLessThan manifests as a use-after-free.
When multiple audio frames are queued in the Segment and a call to
WriteFramesAll or WriteFramesLessThan fails partway through, there
may be null frames left in the Segment frame queue.
This is fixed by dropping the invalid frames and continuing so that the
queue is in a good state after a call, even if it fails.
Found through fuzzing mkvmuxer.
Minimal reproduction case for issue with WriteFramesAll.
```
#include <stdint.h>
#include "mkvmuxer/mkvmuxer.h"
#include "mkvmuxer/mkvwriter.h"
int main() {
mkvmuxer::MkvWriter writer;
writer.Open("file.mkv");
mkvmuxer::Segment segment;
segment.Init(&writer);
uint64_t video_track = segment.AddVideoTrack(1, 1, 0);
uint64_t audio_track = segment.AddAudioTrack(1, 1, 0);
uint8_t data[] = {0};
segment.AddFrame(data, 1, audio_track, 395136991333ULL, false);
segment.AddFrame(data, 1, audio_track, 18374686479674129407ULL, false);
segment.AddFrame(data, 1, video_track, 18446462628926195463ULL, false);
segment.Finalize();
}
```
The second audio frame has an invalid timestamp that is only caught in
WriteFrame from mkvmuxerutil.cc , causing WriteFramesAll to fail on
writing the second audio frame when the first video frame forces a new
cluster.
WriteFramesLessThan has a similar pattern, where failing partway through
a write can leave the Segment in a bad state.
Bug: b/174070314
Test: clang++ *.cc repro.cpp -I.. -o repro -fsanitize=address -g && ./repro
Change-Id: I05c707477e454752776c7571aff9f24f22195d55
|
|
am: e1c992cbab
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504156
Change-Id: I933cf5b00fe54a27c0642cb6886b266e1231293b
|
|
c5427947e7 am: ff579d2ec5 am: 95839a5b03 am: 721d6506da
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504155
Change-Id: Ia7e4b310db6e99bed427cbd810a18991096bc4c3
|
|
739708406b am: 4534b4c172 am: 1643f90bc7
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504154
Change-Id: I6bd462ce47586a293e3460acab209e18a1279372
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504156
Change-Id: Idab0755bf5701e173c08f11506998bd1f0146447
|
|
c5427947e7 am: ff579d2ec5 am: 95839a5b03
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504155
Change-Id: I4741fc2f95eec460ea626cf04bb28cb19ef5645b
|
|
739708406b am: 4534b4c172
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504154
Change-Id: Ia979de631ba44ceb2731eb967ade740b552fa95e
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504156
Change-Id: I6324cd512a88c624857df9c9aacffbe06b7db4e0
|
|
c5427947e7 am: ff579d2ec5
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504155
Change-Id: Ic6e170be795ca45f8887d50856d17973aae206a6
|
|
739708406b
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504154
Change-Id: I613fd1293bc638f7553b76ca4dc721267fc66f41
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504156
Change-Id: I9aec621ced3c445df40354414fc9cc0d7e159b29
|
|
Original change: https://android-review.googlesource.com/c/platform/external/libwebm/+/1504155
Change-Id: Ia7fb6a6daf0bf0eb3e783a084ba8aade082331a5
|