Code: bool ASessionDescription::getDimensions(
 size_t index, unsigned long PT,
 int32_t *width, int32_t *height) const {

     *width = 0;
     *height = 0;
 
    char key[20];
    sprintf(key, "a=framesize:%lu", PT);
     AString value;
     if (!findAttribute(index, key, &value)) {
         return false;
 }

 const char *s = value.c_str();
 char *end;
 *width = strtoul(s, &end, 10);
    CHECK_GT(end, s);
    CHECK_EQ(*end, '-');

    s = end + 1;
 *height = strtoul(s, &end, 10);
    CHECK_GT(end, s);
    CHECK_EQ(*end, '\0');

 return true;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-284
Summary: Multiple buffer overflows in rtsp/ASessionDescription.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 25747670.
Commit Message: Fix corruption via buffer overflow in mediaserver

change unbound sprintf() to snprintf() so network-provided values
can't overflow the buffers.

Applicable to all K/L/M/N branches.

Bug: 25747670
Change-Id: Id6a5120c2d08a6fbbd47deffb680ecf82015f4f6
