Code: void ASessionDescription::getFormatType(
 size_t index, unsigned long *PT,
 AString *desc, AString *params) const {
 AString format;
    getFormat(index, &format);

 const char *lastSpacePos = strrchr(format.c_str(), ' ');
    CHECK(lastSpacePos != NULL);

 char *end;
 unsigned long x = strtoul(lastSpacePos + 1, &end, 10);
    CHECK_GT(end, lastSpacePos + 1);
    CHECK_EQ(*end, '\0');

 
     *PT = x;
 
    char key[20];
    sprintf(key, "a=rtpmap:%lu", x);
 
     CHECK(findAttribute(index, key, desc));
 
    sprintf(key, "a=fmtp:%lu", x);
     if (!findAttribute(index, key, params)) {
         params->clear();
     }
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-284
Summary: Multiple buffer overflows in rtsp/ASessionDescription.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 25747670.
Commit Message: Fix corruption via buffer overflow in mediaserver

change unbound sprintf() to snprintf() so network-provided values
can't overflow the buffers.

Applicable to all K/L/M/N branches.

Bug: 25747670
Change-Id: Id6a5120c2d08a6fbbd47deffb680ecf82015f4f6
