CVE-2024-0049 AI-generated analysis

platform/frameworks/av, media/libstagefright software VPx OMX encoders (SoftVP8Encoder, SoftVP9Encoder, SoftVPXEncoder)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Adds isValidOMXParam() validation at the start of the six VP8/VP9/Android-VPx OMX get/set parameter handlers in the libstagefright software VPx encoders. When the caller-supplied parameter struct fails validation, they now return OMX_ErrorBadParameter and log a SafetyNet event.

Root cause

SoftVP8Encoder::internalGetParameter/internalSetParameter and SoftVP9Encoder::internalGetParameter/internalSetParameter cast the raw OMX_PTR param to OMX_VIDEO_PARAM_VP8TYPE or OMX_VIDEO_PARAM_VP9TYPE. The handlers that receive the cast struct (internalGetVp8Params, internalSetVp8Params, internalGetVp9Params, internalSetVp9Params, and also internalGetAndroidVpxParams and internalSetAndroidVpxParams, which take OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE) immediately read nPortIndex. They then read or write type-specific fields (eProfile, eLevel, nDCTPartitions, nTileColumns, nKeyFrameInterval, a memcpy into nTemporalLayerBitrateRatio, etc.) without first validating the struct with isValidOMXParam(). A parameter buffer that does not match the expected struct can therefore be accessed beyond its bounds.

How the fix works

• media/libstagefright/codecs/on2/enc/SoftVP8Encoder.cpp: SoftVP8Encoder::internalGetVp8Params and SoftVP8Encoder::internalSetVp8Params now call isValidOMXParam(vp8Params) before any field access. On failure they log android_errorWriteLog(0x534e4554, "273936274" / "273937171") and return OMX_ErrorBadParameter.
• media/libstagefright/codecs/on2/enc/SoftVP9Encoder.cpp: SoftVP9Encoder::internalGetVp9Params and SoftVP9Encoder::internalSetVp9Params get the same isValidOMXParam(vp9Params) guard, with bug tags 273936553 / 273937136.
• media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp: SoftVPXEncoder::internalGetAndroidVpxParams and SoftVPXEncoder::internalSetAndroidVpxParams get the isValidOMXParam(vpxAndroidParams) guard, with bug tags 273936601 / 273937551. It sits before the nPortIndex check and before the memcpy into nTemporalLayerBitrateRatio.
• The fix is a single commit (29 added lines, no deletions). The validation lives inside the type-specific handlers rather than in the internalGetParameter/internalSetParameter switch, so every dispatch path into these handlers is covered.

Completeness

• Covers all six type-specific handlers, in both get and set directions: OMX_IndexParamVideoVp8, OMX_IndexParamVideoVp9 and the Android VPx encoder parameters, across the VP8, VP9 and shared VPX encoder classes.
• The fix guards only these VPx-specific handlers. In the shown context, SoftVPXEncoder::internalSetBitrateParams (and the tail of the matching get handler) dereferences bitrate->nPortIndex and other fields, and no isValidOMXParam call is visible in that function. The material does not show whether the SoftVPXEncoder::internalGetParameter/internalSetParameter dispatcher validates the struct.
• The bug tag 273937551 used in internalSetAndroidVpxParams is not among the Bug: lines of the commit message. This is cosmetic and does not affect the check.

Behavior changes

• OMX getParameter/setParameter calls to the software VP8/VP9 encoders now return OMX_ErrorBadParameter, instead of being processed, when a VPx-type parameter struct fails isValidOMXParam.
• Each rejected call emits a SafetyNet log event (android_errorWriteLog with tag 0x534e4554 and the per-handler bug id).
• No change for well-formed parameter structs.

Per major

• Android 14: same fix: commit 6a4f0a82bbf3 landed in android-security-14.0.0_r6 (linked by bug id). At android-security-14.0.0_r29 all 8/8 patched lines are present.
• Android 15: not affected: the bulletin does not list Android 15. The patched region is present (8/8 lines at android-security-15.0.0_r17).
• Android 16: not affected: the bulletin does not list Android 16. SoftVP8Encoder.cpp, SoftVP9Encoder.cpp and SoftVPXEncoder.cpp are absent at android-security-16.0.0_r8.
• Android 17: not affected: the bulletin does not list Android 17. The three patched files are absent at android-security-17.0.0_r1.

Unknowns

• The material does not include the definition of isValidOMXParam. Its semantics (an nSize check against sizeof the parameter type) are inferred from general platform knowledge.
• The material does not show whether SoftVPXEncoder::internalGetParameter/internalSetParameter already validate other parameter types (e.g. OMX_VIDEO_PARAM_BITRATETYPE) before dispatch, or how it dispatches to the Android VPx handlers.
• The POCs referenced in the commit message are not provided.
• Which process hosts these components on a given device is not shown in the material.

Back to March 2024 · Findings