*************************************************************** *************************************************************** 33 file changed, 354 insertions(+), 129 deletions(-) *************************************************************** *************************************************************** ========platform/build between android-8.1.0_r18..android-8.1.0_r22========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) d96195891 Version bump to OPM5.171019.019 8438febd1 [DO NOT MERGE]Update Security String to 2018-04-01 in oc-dev Bug:73240847 (cherry picked from commit accee92300b551449cca63b5b4de93543a77b854) ========device/huawei/angler-kernel between android-8.1.0_r18..android-8.1.0_r22========= Image.gz-dtb | Bin 11135104 -> 11136033 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 1253070 Merge cherrypicks of [3628718, 3628929, 3628848, 3628813, 3628719, 3628980, 3628930, 3628931, 3628903, 3628759, 3629000, 3629001, 3629002, 3629003, 3629040, 3629041, 3629042, 3629043, 3629044, 3629045, 3628974, 3629022, 3628981, 3628849, 3628932, 3628933, 3628934, 3628935, 3628936, 3628937, 3628938, 3628939, 3629060, 3628982, 3628983, 3628984] into oc-m5-release ========platform/external/aac between android-8.1.0_r18..android-8.1.0_r22========= libMpegTPDec/src/tpdec_asc.cpp | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) 1720222 MPEG-4 AAC Decoder: check against invalid height info ========platform/external/libavc between android-8.1.0_r18..android-8.1.0_r22========= decoder/ih264d_parse_headers.c | 4 ++++ decoder/ih264d_parse_slice.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) 860c9da Decoder: Fixed reset values in parse sps. 26e973d Decoder: Set prev slice type for I slice. ========platform/external/libhevc between android-8.1.0_r18..android-8.1.0_r22========= decoder/ihevcd_parse_headers.c | 2 ++ decoder/ihevcd_utils.c | 3 +++ 2 files changed, 5 insertions(+) 9cb5e03 Check limits for log2_max_pic_order_cnt_lsb_minus4 in sps 8ca50b7 Fix output buffer size check ========platform/external/svox between android-8.1.0_r18..android-8.1.0_r22========= pico/tts/svox_ssml_parser.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) 9bd9e4c SVOX: Properly initialize buffers. ========platform/frameworks/av between android-8.1.0_r18..android-8.1.0_r22========= media/libmediaplayerservice/MediaPlayerFactory.cpp | 5 +- media/libmediaplayerservice/MediaPlayerFactory.h | 3 +- media/libmediaplayerservice/MediaPlayerService.cpp | 38 ++++++------ media/libmediaplayerservice/MediaPlayerService.h | 68 +++++++++++++--------- .../include/MediaPlayerInterface.h | 30 +++++----- media/libstagefright/avc_utils.cpp | 2 +- media/libstagefright/httplive/M3UParser.cpp | 7 ++- 7 files changed, 82 insertions(+), 71 deletions(-) 858895a36 Revert "libmedia: Fix null pointer crash in secure buffer allocation." 7765eed4b M3UParser: detect variant streams without EXT-X-STREAM-INF 8a54af87b Refactor MediaPlayerBase's notify db5266410 libmedia: Fix null pointer crash in secure buffer allocation. f3ca351a8 Check NAL size before looking inside bd879f295 Prevent MediaPlayerService::Client's use-after-free ========platform/frameworks/base between android-8.1.0_r18..android-8.1.0_r22========= core/java/android/bluetooth/le/PeriodicAdvertisingReport.java | 2 +- .../java/android/hardware/camera2/params/OutputConfiguration.java | 3 +++ core/java/android/net/Uri.java | 8 ++++++++ .../com/android/internal/widget/VerifyCredentialResponse.java | 2 ++ core/tests/coretests/src/android/net/UriTest.java | 6 ++++++ libs/androidfw/ResourceTypes.cpp | 8 +++++++- wifi/java/android/net/wifi/RttManager.java | 4 ++-- 7 files changed, 29 insertions(+), 4 deletions(-) 2a81c375a3b [RTT] ParcelableRttResults parcel code fix 924b2256e40 Fix VerifyCredentialResponse parcelling code 63e1e342da1 Adjust URI host parsing to stop on \ character. ee1e27b57fd Check for null-terminator in ResStringPool::string8At 6b409511bb3 OutputConfiguration: Fix missing mIsShared in parcel read c3a14982d7e Fix bad type for txPower in PeriodicAdvertisingReport serialization ========platform/frameworks/ex between android-8.1.0_r18..android-8.1.0_r22========= framesequence/jni/FrameSequence_gif.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) 0d81e1e Add bounds checking for transparency lookup ========platform/frameworks/minikin between android-8.1.0_r18..android-8.1.0_r22========= libs/minikin/CmapCoverage.cpp | 24 ++++++++++++++----- tests/unittest/CmapCoverageTest.cpp | 48 +++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+), 6 deletions(-) 85df73e Fix OOB read due to integer overflow ========platform/packages/apps/Email between android-8.1.0_r18..android-8.1.0_r22========= src/com/android/email/activity/ComposeActivityEmail.java | 5 +++++ 1 file changed, 5 insertions(+) 82fa51196 Disallow attaching files from our own EmailAttachmentProvider. ========platform/packages/apps/UnifiedEmail between android-8.1.0_r18..android-8.1.0_r22========= src/com/android/mail/compose/ComposeActivity.java | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) f457b4db3 Disallow attaching files from our own EmailAttachmentProvider. ========platform/system/bt between android-8.1.0_r18..android-8.1.0_r22========= osi/src/config.cc | 15 ++++++++++-- stack/avrc/avrc_pars_ct.cc | 26 ++++++++++++++++---- stack/avrc/avrc_pars_tg.cc | 12 ++++++++-- stack/sdp/sdp_server.cc | 60 ++++++++++++++++++++++++++++++---------------- stack/sdp/sdp_utils.cc | 38 +++++++++++++++++++++++------ 5 files changed, 116 insertions(+), 35 deletions(-) a807cd997 AVRCP: Check number of text attribute values in response 585148802 AVRCP: Set maximum string length when copying to buffer 82aac7454 AVRCP: Initialize buffer for attribute values to be written to 478f53dd9 AVRCP: Check number of text attributes in response 6df0431c2 DO NOT MERGE Truncate new line characters when adding string to config dc4abf8c8 AVRCP: Check the number of text value attributes requested 654eb7ada SDP: Check p_req_end before reading from p_req