Code: bool OMXNodeInstance::handleMessage(omx_message &msg) {
 const sp<GraphicBufferSource>& bufferSource(getGraphicBufferSource());

 
     if (msg.type == omx_message::FILL_BUFFER_DONE) {
         OMX_BUFFERHEADERTYPE *buffer =
            findBufferHeader(msg.u.extended_buffer_data.buffer);
 
         {
             Mutex::Autolock _l(mDebugLock);
            mOutputBuffersWithCodec.remove(buffer);

            CLOG_BUMPED_BUFFER(
                    FBD, WITH_STATS(FULL_BUFFER(
                            msg.u.extended_buffer_data.buffer, buffer, msg.fenceFd)));

            unbumpDebugLevel_l(kPortIndexOutput);
 }

 BufferMeta *buffer_meta =
 static_cast<BufferMeta *>(buffer->pAppPrivate);

 if (buffer->nOffset + buffer->nFilledLen < buffer->nOffset
 || buffer->nOffset + buffer->nFilledLen > buffer->nAllocLen) {
            CLOG_ERROR(onFillBufferDone, OMX_ErrorBadParameter,
                    FULL_BUFFER(NULL, buffer, msg.fenceFd));
 }
        buffer_meta->CopyFromOMX(buffer);

 if (bufferSource != NULL) {
            bufferSource->codecBufferFilled(buffer);

            msg.u.extended_buffer_data.timestamp = buffer->nTimeStamp;

         }
     } else if (msg.type == omx_message::EMPTY_BUFFER_DONE) {
         OMX_BUFFERHEADERTYPE *buffer =
            findBufferHeader(msg.u.buffer_data.buffer);
 
         {
             Mutex::Autolock _l(mDebugLock);
            mInputBuffersWithCodec.remove(buffer);

            CLOG_BUMPED_BUFFER(
                    EBD, WITH_STATS(EMPTY_BUFFER(msg.u.buffer_data.buffer, buffer, msg.fenceFd)));
 }

 if (bufferSource != NULL) {
            bufferSource->codecBufferEmptied(buffer, msg.fenceFd);
 return true;
 }
 }

 return false;
}

Vulnerability Type: Overflow +Priv 
CWE ID: CWE-119
Summary: omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827.
Commit Message: DO NOT MERGE omx: check buffer port before using

Bug: 28816827
Change-Id: I3d5bad4a1ef96dec544b05bb31cc6f7109aae0a5
