CVE-2023-40107 AI-generated analysis

platform/frameworks/av, libstagefright RTSP (ARTPWriter)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds `mVPSBuf = NULL;` to the single-argument `ARTPWriter::ARTPWriter(int fd)` constructor in media/libstagefright/rtsp/ARTPWriter.cpp. Before this, the VPS buffer pointer was left uninitialised while mSPSBuf and mPPSBuf next to it were already initialised.

Root cause

`ARTPWriter::ARTPWriter(int fd)` set `mSPSBuf = NULL` and `mPPSBuf = NULL` but never initialised the sibling member `mVPSBuf`. Per the commit message, if the ARTPWriter object is cleared immediately after this constructor call, the uninitialised pointer could lead to an incorrect free. The material does not show the clearing code itself. The bulletin rates this as a High severity EoP.

How the fix works

• media/libstagefright/rtsp/ARTPWriter.cpp:ARTPWriter::ARTPWriter(int fd): one line is added, `mVPSBuf = NULL;`. It sits just before the existing `mSPSBuf = NULL;` and `mPPSBuf = NULL;` assignments (line 108 at android-security-14.0.0_r29). Because the pointer now starts as NULL, a later clear of a freshly constructed object no longer sees an indeterminate value.

Completeness

• Covers only the single-argument constructor `ARTPWriter(int fd)`. It is the only constructor the commit changes.
• The second constructor `ARTPWriter(int fd, String8& localIp, int localPort, String8& remoteIp, int remotePort, uint32_t seqNo)` (line 127) is in the same file. Its body is not included in the material, so we cannot tell from the code shown whether it initialises mVPSBuf.
• The fix does not change the code that frees the buffers. It relies only on the pointer being NULL at construction.

Behavior changes

• Nothing observable is expected: mVPSBuf now starts as NULL, so clearing a VPS buffer that was never set no longer acts on an indeterminate pointer. There are no new error paths, return codes or validation.

Per major

• Android 14: same fix: commit 1a233e80bc31 landed in android-security-14.0.0_r2 (cherry-picked through partner and googleplex review). At android-security-14.0.0_r29 both lines of the patched region are present.
• Android 15: not affected (not listed by the bulletin); the patched region is present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin); the patched region is present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); the patched region is present at android-security-17.0.0_r1.

Unknowns

• Which clear/free routine in ARTPWriter frees mVPSBuf, and which concrete caller clears the object immediately after construction (the material only gives the commit message and the fuzzer name).
• Whether the six-argument `ARTPWriter(...)` constructor initialises mVPSBuf; its body is not included.
• Whether mVPSBuf is declared with an in-class initialiser in ARTPWriter.h (the header excerpt does not show the member declarations).

Back to November 2023 · Findings