A Demonstration of Stagefright-like Mistakes

A Demonstration of Stagefright-like Mistakes

A Demonstration of Stagefright-like Mistakes Recent weeks have seen huge amounts of media attention on Stagefright, a C++-based component of the Android operating system, responsible for playing various different multimedia files. The Stagefright exploit (itself discussed in more detail in this article ) was fundamentally a result of integer buffer overflows and underflows. While our previous article discussed this in a high level of detail, it has since emerged after the writing of that article, that there is a weakness of the patch made to fix Stagefright. Yes, the patch that's currently being rolled out to devices, which has already hit Nexus devices in the last few days. So now we need another one. There's (some) good news though – the new patch is only a single line change to the source code. You can see the actual patch on AOSP gerrit , which adds yet another bounds-check to an integer variable, to prevent an overflow. The phrase overflow and underflow keep coming up though,

Read full article from A Demonstration of Stagefright-like Mistakes