{"id":13635,"date":"2015-07-29T14:39:35","date_gmt":"2015-07-29T06:39:35","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=13635"},"modified":"2015-08-14T14:57:42","modified_gmt":"2015-08-14T06:57:42","slug":"stagefright-%e6%bc%8f%e6%b4%9e%e9%99%a4%e5%a4%9a%e5%aa%92%e9%ab%94%e7%b0%a1%e8%a8%8a%e4%b9%8b%e5%a4%96%e9%82%84%e6%9c%89%e5%85%b6%e4%bb%96%e6%94%bb%e6%93%8a%e6%96%b9%e5%bc%8f","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=13635","title":{"rendered":"Stagefright \u6f0f\u6d1e\u9664\u591a\u5a92\u9ad4\u7c21\u8a0a\u4e4b\u5916\u9084\u6709\u5176\u4ed6\u653b\u64ca\u65b9\u5f0f"},"content":{"rendered":"

Stagefright \u6f0f\u6d1e\u9664\u591a\u5a92\u9ad4\u7c21\u8a0a\u4e4b\u5916\u9084\u6709\u5176\u4ed6\u653b\u64ca\u65b9\u5f0f<\/strong><\/p>\n

\u7a0d\u65e9Zimperium zLabs<\/a>\u00a0\u63ed\u9732\u4e86\u4e00\u500b\u8b93\u99ed\u5ba2\u7d93\u7531\u7c21\u55ae\u7684\u591a\u5a92\u9ad4\u7c21\u8a0a\u5c31\u80fd\u5728\u88dd\u7f6e\u4e0a\u5b89\u88dd\u60e1\u610f\u7a0b\u5f0f\u7684 Android \u6f0f\u6d1e\u3002\u7531\u65bc\u5176\u6f5b\u5728\u7684\u653b\u64ca\u98a8\u96aa\uff0c\u9019\u500b\u7a31\u70ba\u300cStagefright\u300d(\u602f\u5834) \u7684\u6f0f\u6d1e\u76ee\u524d\u5df2\u7372\u5f97\u76f8\u7576\u5927\u7684\u95dc\u6ce8\u3002\u4f8b\u5982\uff0cStagefright \u53ef\u8b93\u99ed\u5ba2\u767c\u9001\u4e00\u500b\u591a\u5a92\u9ad4\u7c21\u8a0a\u5230\u67d0\u500b\u624b\u6a5f\uff0c\u5c31\u80fd\u5728\u4f7f\u7528\u8005\u4e0d\u77e5\u60c5\u7684\u72c0\u6cc1\u4e0b\u5077\u5077\u5b89\u88dd\u4e00\u500b\u9593\u8adc\u7a0b\u5f0f\u3002\u8acb\u53c3\u8003:\u5f71\u97ff\u4e5d\u6210\u4ee5\u4e0a\u00a0Android\u624b\u6a5f\u56b4\u91cd\u6f0f\u6d1e,\u53ea\u8981\u4e00\u901a\u7279\u88fd\u591a\u5a92\u9ad4\u7c21\u8a0a(MMS),\u5c31\u53ef\u9020\u6210\u624b\u6a5f\u5168\u9762\u7671\u7613!<\/a><\/p>\n

\u5f9e Android 4.0.1 \u81f3 5.1.1 \u7684\u6240\u6709\u7248\u672c\u90fd\u5305\u542b\u6b64\u6f0f\u6d1e\uff0c\u7b49\u65bc\u4eca\u65e5\u4f7f\u7528\u4e2d\u7684 Android \u88dd\u7f6e\u6709\u00a0 94.1% \u90fd\u53d7\u5230\u5f71\u97ff\u3002<\/p>\n

\u9664\u4e86 Zimperium zLabs \u4e4b\u5916\uff0c\u8da8\u52e2\u79d1\u6280\u4e5f\u7368\u529b\u767c\u6398\u4e86\u9019\u9805\u6f0f\u6d1e\uff0c\u4ee5\u4e0b\u8aaa\u660e\u9019\u9805\u6f0f\u6d1e\u7684\u9032\u4e00\u6b65\u8a73\u7d30\u5167\u5bb9\u3002<\/p>\n

\u6f0f\u6d1e\u5206\u6790<\/em><\/strong><\/p>\n

\u5982\u540c\u6211\u5011\u5148\u524d\u767c\u73fe\u7684 Android \u6f0f\u6d1e<\/a>\uff0c\u6b64\u6f0f\u6d1e\u540c\u6a23\u51fa\u73fe\u5728\u5a92\u9ad4\u4f3a\u670d\u5668 (mediaserver<\/em>\u00a0) \u5143\u4ef6\uff0c\u9019\u662f\u4e00\u500b\u8ca0\u8cac\u64ad\u653e\u591a\u5a92\u9ad4\u6a94\u6848\u7684\u5143\u4ef6\u3002<\/p>\n

\u5305\u542b\u6b64\u6f0f\u6d1e\u7684\u00a0mediaserver <\/em>\u7121\u6cd5\u6b63\u5e38\u8655\u7406\u640d\u6bc0\u7684 MP4 \u6a94\u6848\u3002\u56e0\u6b64\uff0c\u7576\u00a0mediaserver<\/em> \u5728\u64ad\u653e\u4e00\u500b\u640d\u6bc0\u7684 MP4 \u6a94\u6848\u6642\uff0c\u6703\u9020\u6210 Heap \u8a18\u61b6\u9ad4\u6ea2\u4f4d\uff0c\u5c0e\u81f4 Heap \u8a18\u61b6\u9ad4\u4e2d\u7684\u8cc7\u6599\u906d\u5230\u8986\u84cb\u3002\u99ed\u5ba2\u53ef\u5229\u7528\u9019\u9ede\u4f86\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c\u9032\u800c\u4e0b\u8f09\u4e00\u500b\u60e1\u610f\u61c9\u7528\u7a0b\u5f0f\u5230\u88dd\u7f6e\u4e0a\u3002<\/p>\n

\u5c0e\u81f4\u6b64\u6f0f\u6d1e\u7684\u539f\u56e0\u662f\u7576\u5a92\u9ad4\u4f3a\u670d\u5668\u5728\u89e3\u6790\u5df2\u640d\u6bc0\u7684 MP4 \u6a94\u6848\u6642\u6703\u767c\u751f\u6574\u6578\u6ea2\u4f4d\u7684\u932f\u8aa4\uff0c\u5c0e\u81f4\u7de9\u885d\u5340\u4ee5\u5916\u7684\u8a18\u61b6\u9ad4\u5167\u5bb9\u906d\u5230\u8986\u5beb\u3002\u66f4\u78ba\u5207\u4e00\u9ede\uff0c\u9019\u662f\u56e0\u70ba mediaserver<\/em> \u5728\u89e3\u6790\u542b\u6709\u00a0tx3g <\/em>\u65d7\u6a19\u7684\u8cc7\u6599\u6642\u6240\u767c\u751f\u7684\u932f\u8aa4\uff0c\u9019\u4e9b\u901a\u5e38\u662f\u63d0\u4f9b\u5b57\u5e55\u7684\u8cc7\u6599\u3002<\/p>\n

\u4ee5\u4e0b\u662f \u00a0frameworks\/av\/media\/libstagefright\/MPEG4Extractor.cpp<\/em> \u7576\u4e2d\u6709\u554f\u984c\u7684\u7a0b\u5f0f\u78bc\uff1a<\/p>\n

1890\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 case FOURCC(‘t’, ‘x’, ‘3’, ‘g’):
\n1891\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 {
\n1892\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 uint32_t type;
\n1893\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 const void *data;
\n1894\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 size_t size = 0;
\n1895\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if (!mLastTrack->meta->findData(
\n1896\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kKeyTextFormatData, &type, &data, &size)) {
\n1897\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 size = 0;
\n1898\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n1899\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/For example,fist time chunk_size == 0x100000,second time chunk_size == 0xFFF00001.Then 0x100000 + 0xFFF00001 = 1, allocate 1 byte indeed.
\n1900\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];
\n1901\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if (buffer == NULL) {
\n1902\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 return ERROR_MALFORMED;
\n1903\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n1904
\n1905\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if (size > 0) {
\n1906\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 memcpy(buffer, data, size);\/\/Still writes 0x100000 bytes in 1 byte\u00a0buffer
\n1907\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n1908
\n1909\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if ((size_t)(mDataSource->readAt(*offset, buffer + size, chunk_size))
\n1910\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 < chunk_size) {
\n1911\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 delete[] buffer;
\n1912\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0buffer = NULL;
\n1913
\n1914\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ advance read pointer so we don’t end up reading this again
\n1915\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *offset += chunk_size;
\n1916\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 return ERROR_IO;
\n1917\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n1918
\n1919\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mLastTrack->meta->setData(
\n1920\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kKeyTextFormatData, 0, buffer, size + chunk_size);
\n1921
\n1922\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 delete[] buffer;
\n1923
\n1924\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *offset += chunk_size;
\n1925\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 break;
\n1926\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

 <\/p>\n

\u6982\u5ff5\u9a57\u8b49\u793a\u7bc4<\/em><\/strong><\/p>\n

\u8da8\u52e2\u79d1\u6280<\/a>\u6e2c\u8a66\u4e86\u4e09\u7a2e mediaserver<\/em> \u53ef\u80fd\u906d\u5230\u653b\u64ca\u7684\u60c5\u5883\u3002\u6211\u5011\u5229\u7528\u300cadb shell top | grep mediaserver<\/em>\u00a0\u300d\u9019\u9053\u6307\u4ee4\u4f86\u5c0d\u5176\u57f7\u884c\u7a0b\u5e8f\u4e0b\u547d\u4ee4\u3002\u6211\u5011\u53ef\u4ee5\u770b\u5230\u00a0mediaserver <\/em>\u7684 PID (Process Identification Number\uff0c\u57f7\u884c\u7a0b\u5e8f\u8b58\u5225\u78bc) \u767c\u751f\u6539\u8b8a\uff0c\u9019\u8868\u793a\u8a72\u57f7\u884c\u7a0b\u5e8f\u5df2\u7d93\u7576\u6389\u7136\u5f8c\u53c8\u91cd\u65b0\u555f\u52d5\u3002<\/p>\n

\u60c5\u5883 1\uff1a\u5f9e\u61c9\u7528\u7a0b\u5f0f\u767c\u52d5\u653b\u64ca<\/em><\/p>\n

\u6b64\u8655\u6211\u5011\u793a\u7bc4\u5982\u4f55\u5f9e\u4e00\u500b\u61c9\u7528\u7a0b\u5f0f\u4f86\u653b\u64ca\u9019\u500b\u6f0f\u6d1e\u3002\u6211\u5011\u7279\u88fd\u7684 MP4 \u6a94\u6848\u6703\u9020\u6210\u00a0mediaserver<\/em> \u7684 Heap \u8a18\u61b6\u9ad4\u906d\u5230\u640d\u6bc0\uff0c\u4e5f\u5c31\u662f\u300c\u906d\u5230\u99ed\u5165\u300d\u3002\u6b64\u8655\u6211\u5011\u53ea\u662f\u8b93\u7a0b\u5f0f\u7576\u6389\u800c\u5df2\uff0c\u4f46\u4e8b\u5be6\u4e0a\u99ed\u5ba2\u53ef\u4ee5\u8b93\u4e00\u6bb5\u7cbe\u5fc3\u88fd\u4f5c\u7684\u8cc7\u6599\u586b\u5165 Heap \u8a18\u61b6\u9ad4\u4e2d\uff0c\u9032\u800c\u638c\u63a7\u7a0b\u5f0f\u7684\u57f7\u884c\u6b0a\u3002<\/p>\n

\"\"<\/p>\n

\u5716 1\uff1amediaserver \u7576\u6389\u6642\u7cfb\u7d71\u7522\u751f\u7684\u9664\u932f\u8cc7\u6599\u3002<\/em><\/p>\n