StageFright is still present in the container

[John McAleely]

While we do not use the whole libstagefright suite in Ubuntu Phones, all the binaries exist inside the lxc container.

This is an oversight in cleaning up the android builds. please make sure these binaries get removed for saving space and not shipping unused android cruft.

With the recent announcement of:

https://www.kb.cert.org/vuls/id/924951

this can cause confusion for users as it is not clear to them these binaries are not used

[John McAleely (john.mcaleely)]

@ubuntu-security--team - I think this bug should probably be public, given the status of the code and vulnerability. should you make that change, or should I?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jim Hodapp (jhodapp)]

Looking at the following page [1] you can see that the patched code is in MPEG4Extractor. For Ubuntu, we don't use this file for anything. We currently only use the opposite code, MPEG4Writer, for when we're recording a video using the camera-app. For playback, GStreamer does indeed do all of the container format parsing for every file type and then passes the extracted video stream chunk by chunk to the MediaCodec class over hybris [2].

[1] https://github.com/WhisperSystems/TextSecure/issues/3817
[2] https://code-review.phablet.ubuntu.com/gitweb?p=ubuntu/libhybris.git;a=blob;f=compat/media/media_codec_layer.cpp;h=9d18f3ed93785a83f09e16d0cf2a68af091fa503;hb=refs/heads/master

[John McAleely (john.mcaleely)]

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Stagefright

[Pat McGowan (pat-mcgowan)]

is this still a valid work item?

[Jamie Strandboge (jdstrand)]

Yes, a whole slew of new stagefright issues came in and the security and phablet teams are having to work through them. Any way we can minimize what is in the android container, the better.