***************************************************************
***************************************************************
  34 file changed, 342 insertions(+), 110 deletions(-)
***************************************************************
***************************************************************
========platform/build between android-7.1.2_r6..android-7.1.2_r11=========
 core/build_id.mk         | 2 +-
 core/version_defaults.mk | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
c1cc1dbfe NHG47L
b382cfef7 Update Security String to 2017-05-05 on nyc-dev
e5dd8a499 Update Security String to 2017-05-01 on nyc-dev

========device/google/marlin-kernel between android-7.1.2_r6..android-7.1.2_r11=========
 Image.gz-dtb | Bin 18641295 -> 18643740 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
61b343d marlin: update prebuilt kernel [ DO NOT MERGE ]

========platform/external/boringssl between android-7.1.2_r6..android-7.1.2_r11=========
 src/crypto/ec/ec.c       |  6 ++++++
 src/crypto/ecdsa/ecdsa.c | 36 ++++++++++++++----------------------
 2 files changed, 20 insertions(+), 22 deletions(-)
08fcdd0 Always use Fermat's Little Theorem in ecdsa_sign_setup.

========platform/external/giflib between android-7.1.2_r6..android-7.1.2_r11=========
 Android.mk             |  1 +
 dgif_lib.c             | 26 ++++++++++++++++++++-----
 egif_lib.c             |  4 ++++
 gif_font.c             | 51 ++++++++++++++++++++++++++++----------------------
 gif_lib.h              |  5 ++++-
 gifalloc.c             | 27 +++++++++++++-------------
 openbsd-reallocarray.c | 39 ++++++++++++++++++++++++++++++++++++++
 7 files changed, 112 insertions(+), 41 deletions(-)
ccd13ed Update GIFLIB to 5.1.4 DO NOT MERGE

========platform/external/libavc between android-7.1.2_r6..android-7.1.2_r11=========
 decoder/ih264d_utils.c | 1 -
 1 file changed, 1 deletion(-)
9b06ccc Decoder: Fixed error handling for dangling fields

========platform/external/libhevc between android-7.1.2_r6..android-7.1.2_r11=========
 decoder/ihevcd_cabac.c              |  9 +++++
 decoder/ihevcd_parse_headers.c      |  4 +++
 decoder/ihevcd_parse_slice.c        | 67 ++++++++++++++++++++++++++-----------
 decoder/ihevcd_parse_slice_header.c |  6 +++-
 4 files changed, 65 insertions(+), 21 deletions(-)
ab14d63 Return error from cabac init if offset is greater than range
e7cd9a6 Handle error return from ref list in slice hdr parsing
ac4084f Return error if SPS parsing reads more bytes than the nal length

========platform/external/libmpeg2 between android-7.1.2_r6..android-7.1.2_r11=========
 decoder/impeg2d_api_main.c | 3 ++-
 decoder/impeg2d_dec_hdr.c  | 4 +++-
 decoder/impeg2d_decoder.c  | 7 +++++++
 3 files changed, 12 insertions(+), 2 deletions(-)
c87c88e Fix in handling header decode errors

========platform/frameworks/av between android-7.1.2_r6..android-7.1.2_r11=========
 media/libstagefright/AMRExtractor.cpp                  |  2 +-
 media/libstagefright/HevcUtils.cpp                     | 16 ++++++++++++++++
 media/libstagefright/NuMediaExtractor.cpp              |  2 +-
 media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp |  9 +++++++++
 .../codecs/m4v_h263/dec/src/mb_motion_comp.cpp         | 18 +++++++++++++++++-
 .../codecs/m4v_h263/dec/src/pvdec_api.cpp              |  7 +++++++
 media/libstagefright/id3/ID3.cpp                       | 12 ++++++++----
 services/audioflinger/Tracks.cpp                       | 17 ++++++++++++++++-
 8 files changed, 75 insertions(+), 8 deletions(-)
b487c707e Add bounds check in SoftAACEncoder2::onQueueFilled()
900af48f2 Fix NPDs in h263 decoder
d766d42f4 Fix out of bounds access
72b9c4f07 Fix integer overflow and divide-by-zero
795d327dd Validate lengths in HEVC metadata parsing
bce047cc9 AudioFlinger: Check framecount overflow when creating track

========platform/frameworks/base between android-7.1.2_r6..android-7.1.2_r11=========
 core/jni/android_database_CursorWindow.cpp              |  8 ++++++++
 core/res/AndroidManifest.xml                            |  2 ++
 include/androidfw/CursorWindow.h                        | 17 ++++++++++++++---
 libs/androidfw/CursorWindow.cpp                         |  5 +++++
 .../com/android/server/pm/PackageManagerService.java    | 14 ++++++++++++++
 5 files changed, 43 insertions(+), 3 deletions(-)
9fa33e71c2a [DO NOT MERGE] Don't allow permission change to runtime
413ebd137fd [DO NOT MERGE] Throw exception if slot has invalid offset
f76189e4593 [DO NOT MERGE] Check bounds in offsetToPtr
6aa27238e1e Fix issue with saving admins before finishing loading.
eea3ed206e8 resolve merge conflicts of ad4aa1ce7d3d to nyc-mr1-dev fix conflict in nyc-mr2-release Change-Id: I97ef31536cd06495a08a3f94f81df2d1376186e0 (cherry picked from commit f806d65e615b942c268a5f68d44bde9d55634972)
4fc5d98812f Protect Bluetooth OPP ACCEPT and DECLINE broadcast

========platform/system/bt between android-7.1.2_r6..android-7.1.2_r11=========
 stack/l2cap/l2c_main.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)
74a7a015 resolve merge conflicts of a3ee2e35 to nyc-dev