In encodeFrames of avcencfuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"152128979686507355399083197395511762325",
"235545754153587913987685669556146839908",
"299391878607679255579570198903437000985",
"214899986774788340182805700242888315087",
"90170871739304703676024247611335011793",
"338341256232503626339833401064382191077",
"319031204955547856882813367115909703360",
"338621859644450332677038639402955710732",
"194612750216407029034858922625555059254",
"48622303887002426794863616126266369657",
"5071574520099667180840358995296431232",
"224440547954643568732075908406388477055",
"210815134797275149822619722424026810468",
"280686452572912265750715486863273193624",
"339315792793344661289450215603944726695",
"48302890080237155647560266910544941623",
"83493336723794550489891997967858810267",
"239812073350062746969484720151900738030",
"203694765653438298258183752664330246534",
"124927458872649891757322455532215470760",
"10645617912484589472704075130130620553"
]
},
"id": "ASB-A-180643802-a1cea66c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"file": "encoder/ih264e_encode.c"
}
},
{
"digest": {
"length": 8478.0,
"function_hash": "63457180486982320506698189365348422781"
},
"id": "ASB-A-180643802-d375a3f0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"function": "ih264e_encode",
"file": "encoder/ih264e_encode.c"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee"
],
"types": [
"ID"
],
"spl": "2021-07-01",
"severity": "High"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"152128979686507355399083197395511762325",
"235545754153587913987685669556146839908",
"299391878607679255579570198903437000985",
"214899986774788340182805700242888315087",
"90170871739304703676024247611335011793",
"338341256232503626339833401064382191077",
"319031204955547856882813367115909703360",
"338621859644450332677038639402955710732",
"194612750216407029034858922625555059254",
"48622303887002426794863616126266369657",
"5071574520099667180840358995296431232",
"224440547954643568732075908406388477055",
"210815134797275149822619722424026810468",
"280686452572912265750715486863273193624",
"339315792793344661289450215603944726695",
"48302890080237155647560266910544941623",
"83493336723794550489891997967858810267",
"239812073350062746969484720151900738030",
"203694765653438298258183752664330246534",
"124927458872649891757322455532215470760",
"10645617912484589472704075130130620553"
]
},
"id": "ASB-A-180643802-2ffd71bc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"file": "encoder/ih264e_encode.c"
}
},
{
"digest": {
"length": 8478.0,
"function_hash": "63457180486982320506698189365348422781"
},
"id": "ASB-A-180643802-a43fe2e3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"function": "ih264e_encode",
"file": "encoder/ih264e_encode.c"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee"
],
"types": [
"ID"
],
"spl": "2021-07-01",
"severity": "High"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"152128979686507355399083197395511762325",
"235545754153587913987685669556146839908",
"299391878607679255579570198903437000985",
"214899986774788340182805700242888315087",
"90170871739304703676024247611335011793",
"338341256232503626339833401064382191077",
"319031204955547856882813367115909703360",
"338621859644450332677038639402955710732",
"194612750216407029034858922625555059254",
"48622303887002426794863616126266369657",
"5071574520099667180840358995296431232",
"224440547954643568732075908406388477055",
"210815134797275149822619722424026810468",
"280686452572912265750715486863273193624",
"339315792793344661289450215603944726695",
"48302890080237155647560266910544941623",
"83493336723794550489891997967858810267",
"239812073350062746969484720151900738030",
"203694765653438298258183752664330246534",
"124927458872649891757322455532215470760",
"10645617912484589472704075130130620553"
]
},
"id": "ASB-A-180643802-6416af33",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"file": "encoder/ih264e_encode.c"
}
},
{
"digest": {
"length": 8478.0,
"function_hash": "63457180486982320506698189365348422781"
},
"id": "ASB-A-180643802-9d5dface",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"function": "ih264e_encode",
"file": "encoder/ih264e_encode.c"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee"
],
"types": [
"ID"
],
"spl": "2021-07-01",
"severity": "High"
}
{
"vanir_signatures": [
{
"digest": {
"length": 8478.0,
"function_hash": "63457180486982320506698189365348422781"
},
"id": "ASB-A-180643802-1c22b89d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"function": "ih264e_encode",
"file": "encoder/ih264e_encode.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"152128979686507355399083197395511762325",
"235545754153587913987685669556146839908",
"299391878607679255579570198903437000985",
"214899986774788340182805700242888315087",
"90170871739304703676024247611335011793",
"338341256232503626339833401064382191077",
"319031204955547856882813367115909703360",
"338621859644450332677038639402955710732",
"194612750216407029034858922625555059254",
"48622303887002426794863616126266369657",
"5071574520099667180840358995296431232",
"224440547954643568732075908406388477055",
"210815134797275149822619722424026810468",
"280686452572912265750715486863273193624",
"339315792793344661289450215603944726695",
"48302890080237155647560266910544941623",
"83493336723794550489891997967858810267",
"239812073350062746969484720151900738030",
"203694765653438298258183752664330246534",
"124927458872649891757322455532215470760",
"10645617912484589472704075130130620553"
]
},
"id": "ASB-A-180643802-616588c0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee",
"target": {
"file": "encoder/ih264e_encode.c"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/external/libavc/+/3e73f0d56298ba6256927928669d0cc6e4b1c9ee"
],
"types": [
"ID"
],
"spl": "2021-07-01",
"severity": "High"
}