CVE-2024-40658 AI-generated analysis
platform/frameworks/av, libstagefright OMX software video decoder (media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp)
Adds a size consistency check in SoftVideoDecoderOMXComponent::getConfig for kDescribeHdr10PlusInfoIndex. It rejects a client-supplied nParamSize larger than the trailing storage described by nSize, before the HDR10+ info is memcpy'd into outParams->nValue.
Root cause
In SoftVideoDecoderOMXComponent::getConfig, case kDescribeHdr10PlusInfoIndex, the only check on the client-supplied DescribeHDR10PlusInfoParams was isValidOMXParam(outParams). The code then treated the client-controlled outParams->nParamSize as the capacity of the trailing nValue array: if nParamSize >= info->size(), it ran memcpy(outParams->nValue, info->data(), info->size()). Nothing checked that offsetof(DescribeHDR10PlusInfoParams, nValue) + nParamSize fits within the declared structure size nSize. A caller could therefore claim an nParamSize larger than the space described by nSize, and the memcpy could write past the declared end of the params structure.
How the fix works
- media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp:SoftVideoDecoderOMXComponent::getConfig (case kDescribeHdr10PlusInfoIndex): right after isValidOMXParam(outParams), a new check returns OMX_ErrorBadParameter when offsetof(DescribeHDR10PlusInfoParams, nValue) + outParams->nParamSize > outParams->nSize. This ties the claimed payload capacity (nParamSize) to the declared total structure size (nSize), so the later memcpy, which only runs when 'outParams->nParamSize >= info->size()', can only write within the structure described by nSize.
- On rejection the fix logs ALOGE with the bug id and calls android_errorWriteLog(0x534e4554, "329641908"), then returns OMX_ErrorBadParameter.
- Single commit, 7 lines added, no other files touched.
Completeness
- The fix covers the only memcpy into outParams->nValue in the kDescribeHdr10PlusInfoIndex branch of getConfig. The check runs before nParamSizeUsed is written and before the memcpy, so it gates both the copy and the erase of the pending entry.
- The check relies on nSize matching the real allocation. The material does not show whether isValidOMXParam or the caller enforces this.
- Only the getConfig (output) direction changes. The internalSetConfig path (it starts at line 648 in the shown context) and any HDR10+ input handling are not shown in the material, and this commit does not touch them.
- Other OMX components with their own getConfig (for example the Goldfish and Qualcomm vendor decoders, per index search) are separate code that this fix does not modify. The material does not show whether they implement an HDR10+ info query.
Behavior changes
- getConfig(kDescribeHdr10PlusInfoIndex) now returns OMX_ErrorBadParameter when offsetof(DescribeHDR10PlusInfoParams, nValue) + nParamSize > nSize, instead of continuing.
- On rejection the component now emits a new ALOGE line and an android_errorWriteLog(0x534e4554, "329641908") event.
- Well-formed clients whose nParamSize fits within the storage after nValue inside nSize see no change.
Per major
- Android 14: same fix: commit 6d23fa05a40e (a cherry-pick) in android-security-14.0.0_r12, linked by bug 329641908. At android-security-14.0.0_r29, 3/3 lines of the patched region are present.
- Android 15: same fix: commit 899a582bba88 (identical diff) is in the android-15.0.0_r1 base. At android-security-15.0.0_r17, 3/3 lines are present.
- Android 16: not affected (the bulletin does not list it). The patched region is present at android-security-16.0.0_r8 (3/3 lines).
- Android 17: not affected (the bulletin does not list it). The patched region is present at android-security-17.0.0_r1 (3/3 lines).
Unknowns
- Whether internalSetConfig or any HDR10+ input-side path uses nParamSize without a similar check. The material does not show that code.
- The exact definition of DescribeHDR10PlusInfoParams and what isValidOMXParam enforces on nSize. Neither is included in the material.
- Whether nSize is guaranteed to match the real size of the params buffer supplied by the caller.
- Which process hosts the component on affected devices, and so the concrete privilege boundary. The bulletin only states High / EoP.
- How the fix looks on 12, 12L and 13.