*************************************************************** *************************************************************** 59 file changed, 894 insertions(+), 416 deletions(-) *************************************************************** *************************************************************** ========platform/build between android-7.1.2_r27..android-7.1.2_r33========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) 8ec0a7127 Version bump to NZH54D 051c66da6 [DO NOT MERGE] Updating Security String to 2017-08-05 on nyc-dev bug:62388772 (cherry picked from commit 2b93753bc4025e92e6b6c8ed510bc9b3f8faff4d) 9a6300a8c [DO NOT MERGE] Updating Security String to 2017-08-01 on nyc-dev bug:62388772 (cherry picked from commit a847c0b23ce761b09148f4f8fd6c9b473a46f531) ========device/google/marlin-kernel between android-7.1.2_r27..android-7.1.2_r33========= Image.gz-dtb | Bin 18647444 -> 18628076 bytes 1 file changed, 0 insertions(+), 0 deletions(-) b7a6ad9 Merge cherrypicks of [2479290] into nyc-mr2-security-c-release ========platform/external/libavc between android-7.1.2_r27..android-7.1.2_r33========= decoder/ih264d_api.c | 3 +-- decoder/ih264d_dpb_mgr.c | 21 +++++++++++---- decoder/ih264d_parse_bslice.c | 17 ++----------- decoder/ih264d_parse_headers.c | 58 ++++++++++++++++++++++++++---------------- decoder/ih264d_parse_pslice.c | 18 +------------ decoder/ih264d_parse_slice.c | 8 ++---- decoder/ih264d_structs.h | 3 +-- decoder/ih264d_utils.c | 5 +--- 8 files changed, 60 insertions(+), 73 deletions(-) 15c99e6 Fixed hang in the case of multiple sps id. c4b3e49 Decoder: Fix in the case of MMCO 6 dbe47a0 Decoder: Cleaned up parse sps function. 7d957aa Initializing reference list for every P/B slice. f91e789 Fix resolution change within a decode call. 64f74e6 Decoder: Fixed allocation size of pred info buffer 21c1a83 DO NOT MERGE Fixed bug in the case of resolution change. ========platform/external/libhevc between android-7.1.2_r27..android-7.1.2_r33========= decoder/ihevcd_nal.c | 7 ++- decoder/ihevcd_parse_slice.c | 130 ++++++++++++++++++++++++++++++++++++------- decoder/ihevcd_utils.c | 4 +- 3 files changed, 116 insertions(+), 25 deletions(-) c9a7c12 Fix OOB issue in nal unit parsing fa0f6b3 Set pic_present at end of pic_init instead of beginning ecd109a Handle error return in parse slice ========platform/external/libmpeg2 between android-7.1.2_r27..android-7.1.2_r33========= decoder/impeg2d_dec_hdr.c | 29 +++++++++++++++++++++--- decoder/impeg2d_vld.c | 57 +++++++++++++++++++++++++++++++++-------------- 2 files changed, 66 insertions(+), 20 deletions(-) 91b7ebf Correcting NumCoeff Check in VLD 4c1b660 Adding Error Check For PictureStructure Param 6cbe874 Update mbs_left In Case Of Missing Slice 65250a1 Check For Zero Width/Height in Frame Header ========platform/external/sfntly between android-7.1.2_r27..android-7.1.2_r33========= README.android | 13 ++- README.md | 17 +++ cpp/src/sample/chromium/font_subsetter.cc | 21 ++++ cpp/src/sample/chromium/font_subsetter.h | 26 ++++- cpp/src/sample/chromium/subsetter_impl.cc | 18 +++ cpp/src/sample/chromium/subsetter_impl.h | 3 + cpp/src/sample/subtly/font_assembler.cc | 2 + cpp/src/sfntly/data/byte_array.cc | 2 + cpp/src/sfntly/data/font_data.cc | 44 +++++--- cpp/src/sfntly/data/font_data.h | 15 +-- cpp/src/sfntly/data/readable_font_data.cc | 131 ++++++++++++++++------ cpp/src/sfntly/data/readable_font_data.h | 25 +++-- cpp/src/sfntly/data/writable_font_data.cc | 9 +- cpp/src/sfntly/font.cc | 113 +++++++++++-------- cpp/src/sfntly/font.h | 2 +- cpp/src/sfntly/port/file_input_stream.cc | 2 + cpp/src/sfntly/port/logging.h | 31 +++++ cpp/src/sfntly/port/memory_input_stream.cc | 2 + cpp/src/sfntly/port/refcount.h | 21 ++-- cpp/src/sfntly/port/type.h | 2 +- cpp/src/sfntly/table/core/font_header_table.cc | 5 +- cpp/src/sfntly/table/core/font_header_table.h | 1 + cpp/src/sfntly/table/core/name_table.cc | 10 +- cpp/src/sfntly/table/core/os2_table.cc | 2 + cpp/src/sfntly/table/table_based_table_builder.cc | 6 +- cpp/src/sfntly/table/truetype/glyph_table.cc | 9 +- 26 files changed, 378 insertions(+), 154 deletions(-) 3bfd840 Merge remote-tracking branch 'aosp/upstream-master' into master 8dd6338 Merge commit 'bbc9221' into master ========platform/external/skia between android-7.1.2_r27..android-7.1.2_r33========= resources/invalid_images/b33651913.bmp | Bin 0 -> 3190 bytes src/codec/SkBmpCodec.cpp | 181 +++++++++++++++++---------------- tests/CodexTest.cpp | 16 +++ 3 files changed, 112 insertions(+), 85 deletions(-) 39d0d0b36 Stop supporting kUnknown_BmpHeaderType DO NOT MERGE ========platform/frameworks/av between android-7.1.2_r27..android-7.1.2_r33========= drm/mediadrm/plugins/clearkey/InitDataParser.cpp | 2 +- .../libeffects/lvm/wrapper/Bundle/EffectBundle.cpp | 34 +++++++++++++++++-- media/libstagefright/MPEG4Extractor.cpp | 4 ++- .../codecs/m4v_h263/dec/SoftMPEG4.cpp | 23 ++++++++++--- .../libstagefright/codecs/m4v_h263/dec/src/vop.cpp | 18 +++++++--- .../codecs/m4v_h263/enc/src/mp4enc_api.cpp | 28 +++++++--------- .../codecs/m4v_h263/enc/src/mp4lib_int.h | 1 + media/libstagefright/omx/GraphicBufferSource.cpp | 38 ++++++++++++++++------ media/libstagefright/omx/GraphicBufferSource.h | 6 +--- media/libstagefright/omx/OMXNodeInstance.cpp | 2 +- 10 files changed, 110 insertions(+), 46 deletions(-) 7690cce2b Fix security vulnerability: Equalizer setParameter memory overflow 886bbc02d RESTRICT AUTOMERGE Check the buffer index from acquireBuffer adbef2fea better manage buffer for libstagefright_soft_mpeg4enc 3ad7da100 m4v_h263: update width/height only when they are valid. c7e57e89f m4v_h263: check header first before decoding a frame. a2cf7805e Fix integer overflow in mediadrmserver 6a39a0af9 Fix potential leak e0efb3284 DO NOT MERGE Don't leak `this` out of GraphicBufferSource ctor ========platform/frameworks/base between android-7.1.2_r27..android-7.1.2_r33========= media/java/android/media/MediaHTTPConnection.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) 66aa8bd068b Close connection before retrying ========platform/frameworks/native between android-7.1.2_r27..android-7.1.2_r33========= libs/gui/BufferQueueProducer.cpp | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) ca1a1094a fix race condition that can cause a use after free ========platform/frameworks/opt/net/wifi between android-7.1.2_r27..android-7.1.2_r33========= service/jni/com_android_server_wifi_WifiNative.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) d6fbcb099 cherry-pick: wifinative jni: check array length for trackSignificantWifiChange ========platform/hardware/qcom/audio between android-7.1.2_r27..android-7.1.2_r33========= post_proc/equalizer.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) ab02f2d Fix security vulnerability: Equalizer setParameter memory overflow