tag 482ff1c5a2c157d949dd3af491e2d2d4525a3133
tagger The Android Open Source Project <initial-contribution@android.com> Mon Mar 07 11:02:13 2016 -0800
object 8e1c005a6066256af9b6923c717b7a36f6423c51

Android 5.1.1 release 35

commit 8e1c005a6066256af9b6923c717b7a36f6423c51
author Robert Shih <robertshih@google.com> Tue Aug 25 15:24:08 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 13:48:11 2015 -0700
tree 03941b8ae745c81691c3d4d62929d9bf2a2eac18
parent 4d751795efebe9a1154b3dfaf544c7c4d87243c7

test if libFLAC is patched against CVE-2014-9028

Overview of CVE-2014-9028:

Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1
allows remote attackers to execute arbitrary code via a crafted .flac
file.

(source: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9028)

heap_oob_flac has a .mp3 extension to avoid compresstion by aapt. When a
resource file is compressed openRawResourceFd would fail. Please refer
to kNoCompressExt in frameworks/base/tools/aapt/Package.cpp for more
details.

Bug: 23238405
Change-Id: I7c13b19beb83c10fced360537a84b2f053ce8a26