Code: OMX_ERRORTYPE SoftAVC::internalSetParameter(OMX_INDEXTYPE index, const OMX_PTR params) {
 int32_t indexFull = index;


     switch (indexFull) {
         case OMX_IndexParamVideoBitrate:
         {
            return internalSetBitrateParams(
                    (const OMX_VIDEO_PARAM_BITRATETYPE *)params);
         }
 
         case OMX_IndexParamVideoAvc:
         {
             OMX_VIDEO_PARAM_AVCTYPE *avcType = (OMX_VIDEO_PARAM_AVCTYPE *)params;
 
             if (avcType->nPortIndex != 1) {
                 return OMX_ErrorUndefined;
             }

            mEntropyMode = 0;

 if (OMX_TRUE == avcType->bEntropyCodingCABAC)
                mEntropyMode = 1;

 if ((avcType->nAllowedPictureTypes & OMX_VIDEO_PictureTypeB) &&
                    avcType->nPFrames) {
                mBframes = avcType->nBFrames / avcType->nPFrames;
 }

            mIInterval = avcType->nPFrames + avcType->nBFrames;

 if (OMX_VIDEO_AVCLoopFilterDisable == avcType->eLoopFilterMode)
                mDisableDeblkLevel = 4;

 if (avcType->nRefFrames != 1
 || avcType->bUseHadamard != OMX_TRUE
 || avcType->nRefIdx10ActiveMinus1 != 0
 || avcType->nRefIdx11ActiveMinus1 != 0
 || avcType->bWeightedPPrediction != OMX_FALSE
 || avcType->bconstIpred != OMX_FALSE
 || avcType->bDirect8x8Inference != OMX_FALSE
 || avcType->bDirectSpatialTemporal != OMX_FALSE
 || avcType->nCabacInitIdc != 0) {
 return OMX_ErrorUndefined;
 }

 if (OK != ConvertOmxAvcLevelToAvcSpecLevel(avcType->eLevel, &mAVCEncLevel)) {
 return OMX_ErrorUndefined;
 }

 return OMX_ErrorNone;
 }

 default:
 return SoftVideoEncoderOMXComponent::internalSetParameter(index, params);
 }
}

Vulnerability Type: Overflow +Priv 
CWE ID: CWE-119
Summary: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27207275.
Commit Message: DO NOT MERGE Verify OMX buffer sizes prior to access

Bug: 27207275
Change-Id: I4412825d1ee233d993af0a67708bea54304ff62d
