*************************************************************** *************************************************************** 39 file changed, 480 insertions(+), 122 deletions(-) *************************************************************** *************************************************************** ========platform/build between android-7.0.0_r1..android-7.0.0_r4========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) a576db2 "NRD90S" 8aafa4c "NRD90R" b960cf8 Update Security String to 2016-09-06 to platform and CTS for September Security (+Quadrooter,-PZ) 98295db "NRD90Q" 580a30e "NRD90P" abb6d47 Update Security String to 2016-09-07 to platform and CTS for September respin d010e75 "NRD90O" 8ac0be7 NRD90N 732492b Updating security string to 2016-09-05 to platform and CTS in preparation for 2016 September OTA on mnc-dev ========device/huawei/angler-kernel between android-7.0.0_r1..android-7.0.0_r4========= Image.gz-dtb | Bin 11287262 -> 11286702 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 273fbd3 angler: update prebuilt kernel [ DO NOT MERGE ] 99e123e angler: update prebuilt kernel [ DO NOT MERGE ] ========device/lge/bullhead-kernel between android-7.0.0_r1..android-7.0.0_r4========= Image.gz-dtb | Bin 10869552 -> 10868019 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 0e62cab bullhead: update prebuilt kernel [ DO NOT MERGE ] dded318 bullhead: update prebuilt kernel [ DO NOT MERGE ] ========platform/external/jhead between android-7.0.0_r1..android-7.0.0_r4========= gpsinfo.c | 2 +- makernote.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) 2f16b77 Fix possible out of bounds accesses ========platform/external/libvpx between android-7.0.0_r1..android-7.0.0_r4========= libvpx/vp9/vp9_dx_iface.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) 4974dcb DO NOT MERGE | libvpx: cherry-pick aa1c813 from upstream ========platform/frameworks/av between android-7.0.0_r1..android-7.0.0_r4========= media/libmediaplayerservice/MediaPlayerService.cpp | 3 +- media/libstagefright/SampleTable.cpp | 165 +++++++++++++++++---- media/libstagefright/Utils.cpp | 21 +-- media/libstagefright/codecs/mp3dec/SoftMP3.cpp | 22 ++- media/libstagefright/codecs/mp3dec/SoftMP3.h | 1 + media/libstagefright/codecs/on2/dec/SoftVPX.cpp | 23 ++- media/libstagefright/codecs/on2/dec/SoftVPX.h | 1 + media/libstagefright/include/SampleTable.h | 9 +- .../libstagefright/omx/SimpleSoftOMXComponent.cpp | 7 + media/libstagefright/rtsp/ASessionDescription.cpp | 14 +- 10 files changed, 209 insertions(+), 57 deletions(-) 1e98017 omx: prevent input port enable/disable for software codecs c17ad2f Fix build 3c4edac Fix build 3944c65 Add bound checks to utf16_to_utf8 9f9ba25 fix build 630ed15 SoftVPX: fix nFilledLen overflow 68f67ef Fix corruption via buffer overflow in mediaserver c2639af SoftMP3: memset safely 119a012 stagefright: fix possible stack overflow in AVCC reassemble 5ecb86f DO NOT MERGE - stagefright: fix integer overflow error 8a74b92 Impose a size bound for dynamically allocated tables in stbl. ========platform/frameworks/base between android-7.0.0_r1..android-7.0.0_r4========= .../src/com/android/settingslib/HelpUtils.java | 7 ++++++ .../com/android/settingslib/drawer/TileUtils.java | 7 +++++- .../providers/settings/SettingsProvider.java | 22 ++++++++++++++++--- .../statusbar/phone/QuickStatusBarHeader.java | 25 ++++++++++++---------- .../notification/NotificationManagerService.java | 5 +++++ .../com/android/server/pm/UserManagerService.java | 2 +- .../android/server/pm/UserRestrictionsUtils.java | 3 +++ tools/aapt/Android.mk | 2 +- tools/aapt2/util/Util.cpp | 4 +++- tools/split-select/Android.mk | 2 +- 10 files changed, 60 insertions(+), 19 deletions(-) c372cb6 Allow apps with CREATE_USERS permission to call UM.getProfiles. 6ca6cd5 Don't allow enable/disable of tuner on lockscreen 91fc934 Block user from setting safe boot setting via adb 866dc26 Add bound checks to utf16_to_utf8 335702d Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set e206f02 Pre-setup restrictions 61e9103 Check uid for notification policy access. ========platform/frameworks/native between android-7.0.0_r1..android-7.0.0_r4========= libs/binder/Parcel.cpp | 11 ++++++----- libs/ui/Region.cpp | 5 +++++ 2 files changed, 11 insertions(+), 5 deletions(-) 3632479 Region: Detect malicious overflow in unflatten 1f4b49e Add bound checks to utf16_to_utf8 ========platform/frameworks/opt/telephony between android-7.0.0_r1..android-7.0.0_r4========= .../android/internal/telephony/SMSDispatcher.java | 59 +++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) b8d1aee Do not allow premium SMS during SuW b2c89e6 DO NOT MERGE add private function convertSafeLable ========platform/packages/apps/CellBroadcastReceiver between android-7.0.0_r1..android-7.0.0_r4========= .../android/cellbroadcastreceiver/CellBroadcastConfigService.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) bc4661c Fixed that emergency messages are not enabled for Japanese carriers fa4425a Revert "Fixed that emergency messages are not enabled for Japanese carriers" 0b2682d Fixed that emergency messages are not enabled for Japanese carriers f4177dd Revert "Fixed that emergency messages are not enabled for Japanese carriers" edbdbad Fixed that emergency messages are not enabled for Japanese carriers ========platform/packages/apps/PackageInstaller between android-7.0.0_r1..android-7.0.0_r4========= .../android/packageinstaller/permission/ui/OverlayTouchActivity.java | 2 ++ 1 file changed, 2 insertions(+) 6c84557 Hide toast windows when permissions UI shown ========platform/packages/apps/Settings between android-7.0.0_r1..android-7.0.0_r4========= src/com/android/settings/users/UserSettings.java | 6 ++++++ 1 file changed, 6 insertions(+) bd5d517 Pre-setup restrictions ========platform/packages/services/Telephony between android-7.0.0_r1..android-7.0.0_r4========= AndroidManifest.xml | 2 ++ 1 file changed, 2 insertions(+) d1d248d Make TTY broadcasts protected ========platform/system/core between android-7.0.0_r1..android-7.0.0_r4========= debuggerd/debuggerd.cpp | 74 ++++++++++++++++++++++++++++++++++------- include/utils/Unicode.h | 4 +-- libutils/String8.cpp | 25 +++++++------- libutils/Unicode.cpp | 15 ++++++--- libutils/tests/String8_test.cpp | 19 +++++++++++ 5 files changed, 107 insertions(+), 30 deletions(-) ecf5fd5 libutils/Unicode.cpp: Correct length computation and add checks for utf16->utf8 d760358 debuggerd: verify that traced threads belong to the right process.