CVE-2024-0050 AI-generated analysis
platform/frameworks/av, libstagefright OMX software video decoder base class (media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp)
Adds isValidOMXParam() validation of the client-supplied DescribeHDR10PlusInfoParams structure in SoftVideoDecoderOMXComponent::getConfig and SoftVideoDecoderOMXComponent::internalSetConfig before the structure is used.
Root cause
In SoftVideoDecoderOMXComponent.cpp, the kDescribeHdr10PlusInfoIndex handlers in getConfig() and internalSetConfig() cast the caller-supplied OMX_PTR params directly to DescribeHDR10PlusInfoParams. They then used it without the isValidOMXParam() check that sibling cases perform (e.g. DescribeHDRStaticInfoParams in getConfig, lines 589-594 at r29). getConfig() then wrote outParams->nParamSizeUsed and memcpy'd info->data() into outParams->nValue, based on outParams->nParamSize. internalSetConfig() went on to its frameConfig / HDR10+ handling. In neither case was the structure's declared size checked.
How the fix works
- media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp:SoftVideoDecoderOMXComponent::getConfig, case kDescribeHdr10PlusInfoIndex: after params is cast to DescribeHDR10PlusInfoParams* outParams, adds `if (!isValidOMXParam(outParams)) return OMX_ErrorBadParameter;`. The check runs before nParamSizeUsed is written and before the memcpy into nValue. It sits inside the existing supportDescribeHdr10PlusInfo() guard and the mHdr10PlusOutputs.size() > 0 branch.
- media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp:SoftVideoDecoderOMXComponent::internalSetConfig, case kDescribeHdr10PlusInfoIndex: after params is cast to const DescribeHDR10PlusInfoParams* inParams, adds the same isValidOMXParam(inParams) check returning OMX_ErrorBadParameter. The check runs before the `if (*frameConfig)` append logic.
- Single commit, 8 added lines, no other logic changed.
Completeness
- Covers both the get and set paths for kDescribeHdr10PlusInfoIndex in the shared software decoder base class. This matches the isValidOMXParam pattern already used by other cases in getConfig (e.g. DescribeHDRStaticInfoParams).
- The fix validates only the structure header via isValidOMXParam. It does not check that outParams->nParamSize fits within outParams->nSize, so the variable-length memcpy into nValue is still bounded by the client-declared nParamSize. The code at android-security-14.0.0_r29 contains a later, separate check (`offsetof(DescribeHDR10PlusInfoParams, nValue) + outParams->nParamSize > outParams->nSize`, logged as b/329641908) that closes this gap. That check is not part of this CVE's commit.
- Only SoftVideoDecoderOMXComponent.cpp is touched. Derived or vendor components that reimplement getConfig/internalSetConfig are not covered by this commit.
Behavior changes
- getConfig(kDescribeHdr10PlusInfoIndex) returns OMX_ErrorBadParameter when the supplied DescribeHDR10PlusInfoParams fails isValidOMXParam(). This applies only when HDR10+ support is enabled and HDR10+ outputs are pending.
- setConfig (via internalSetConfig) with kDescribeHdr10PlusInfoIndex returns OMX_ErrorBadParameter when the structure fails isValidOMXParam().
- No change for well-formed parameters.
Per major
- Android 14: same fix: commit 23a035af9be9 in android-security-14.0.0_r6 (cherry-pick of a542f2c50700, Change-Id I707745594a9196d8d85d4c4bb498eba3c6198b42). All 8 patched lines are present at android-security-14.0.0_r29, along with a later, additional nParamSize-vs-nSize check (b/329641908) in getConfig.
- Android 15: not affected per the bulletin; the 8 patched lines are present at android-security-15.0.0_r17.
- Android 16: not affected per the bulletin; the 8 patched lines are present at android-security-16.0.0_r8.
- Android 17: not affected per the bulletin; the 8 patched lines are present at android-security-17.0.0_r1.
Unknowns
- The material does not show the concrete memory-safety consequence or the trigger used in the bug reports (273935108, 281065553).
- The material does not show whether the Android 12/12L/13 branches listed as affected received the same commit.
- The guards preceding the kDescribeHdr10PlusInfoIndex case in internalSetConfig and the fields it reads after the check are not shown.
- Whether vendor or emulator derivatives (e.g. device/generic/goldfish-opengl GoldfishVideoDecoderOMXComponent.cpp) implement the kDescribeHdr10PlusInfoIndex case is not shown.