*************************************************************** *************************************************************** 114 file changed, 1421 insertions(+), 658 deletions(-) *************************************************************** *************************************************************** ========platform/art between android-8.1.0_r2..android-8.1.0_r7========= runtime/gc/space/image_space.cc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) b6ea7dad7e ART: Reinstate secondary-image-patching exit ========platform/build between android-8.1.0_r2..android-8.1.0_r7========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) 854099edf Version bump to OPM3.171019.013 2e868cf11 [DO NOT MERGE] Update Security String to 2018-01-05 from 2018-01-01 Bug: 69257226 (cherry picked from commit b58800a22c230eeac0d2a6fe5ded7a76a95a4a5f) 1f073b015 [DO NOT MERGE] Update Security String to 2018-01-01 from 2017-12-05 Bug: 69257226 (cherry picked from commit c53a14f1745cd302cb4951ed803679770ba584c4) ========platform/cts between android-8.1.0_r2..android-8.1.0_r7========= tests/tests/net/src/android/net/cts/UriTest.java | 5 +++ tests/tests/security/res/raw/bug_67737022.mp4 | Bin 0 -> 102400 bytes .../src/android/security/cts/BitmapTest.java | 41 +++++++++++++++++++++ .../src/android/security/cts/EffectBundleTest.java | 11 ++++++ .../src/android/security/cts/StagefrightTest.java | 11 ++++++ 5 files changed, 68 insertions(+) 99534de18a Add CTS test for URI fix. 8b09079981 Verify b/67737022 fix presence baf40519cf Test that createBitmap(65535,65535) throws OOME 2efac157a9 Add EffectBundleTest ========device/asus/fugu-kernel between android-8.1.0_r2..android-8.1.0_r7========= e739991 Snap for 4448085 from c488c7e1dc88194c546c436eda6f7f24dc1b08be to oc-m3-release ========device/google/dragon-kernel between android-8.1.0_r2..android-8.1.0_r7========= 1cf69dd Snap for 4448085 from 58436290edb911230e2580eef3b1dc1941a2389b to oc-m3-release ========device/google/marlin-kernel between android-8.1.0_r2..android-8.1.0_r7========= 7cdb3cc Snap for 4448085 from 3d73c9315d1da199bb3319f16f9558a8d0012172 to oc-m3-release ========device/google/wahoo-kernel between android-8.1.0_r2..android-8.1.0_r7========= 4a11973 Snap for 4448085 from ff3ad8367361fc9f69b4b2947f14b44a2fdaf74c to oc-m3-release ========device/huawei/angler-kernel between android-8.1.0_r2..android-8.1.0_r7========= Image.gz-dtb | Bin 11170111 -> 11135939 bytes 1 file changed, 0 insertions(+), 0 deletions(-) cb0e0fe Merge cherrypicks of [3287457, 3287458, 3286978, 3286979, 3287477, 3287478, 3287479, 3287480, 3287517, 3287518, 3287537, 3287538, 3287539, 3287540, 3287481, 3287482, 3287483, 3287484, 3287485, 3287486, 3287487, 3287488, 3287359, 3287459, 3287360, 3287361, 3287362, 3287363, 3287364, 3287365, 3287366, 3287367, 3287489, 3287490, 3287491, 3287557, 3287577, 3287558, 3287492, 3287493, 3287597, 3287617, 3286980, 3287460, 3287494] into oc-m3-release ========device/lge/bullhead-kernel between android-8.1.0_r2..android-8.1.0_r7========= Image.gz-dtb | Bin 10826886 -> 10826149 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 2b68c60 Merge cherrypicks of [3287457, 3287458, 3286978, 3286979, 3287477, 3287478, 3287479, 3287480, 3287517, 3287518, 3287537, 3287538, 3287539, 3287540, 3287481, 3287482, 3287483, 3287484, 3287485, 3287486, 3287487, 3287488, 3287359, 3287459, 3287360, 3287361, 3287362, 3287363, 3287364, 3287365, 3287366, 3287367, 3287489, 3287490, 3287491, 3287557, 3287577, 3287558, 3287492, 3287493, 3287597, 3287617, 3286980, 3287460, 3287494] into oc-m3-release ========platform/external/aac between android-8.1.0_r2..android-8.1.0_r7========= libFDK/include/fixpoint_math.h | 12 ++++++++---- libSBRdec/src/lpp_tran.cpp | 10 +++++++--- 2 files changed, 15 insertions(+), 7 deletions(-) 7172d9a DO NOT MERGE Prevent out of bound memory access in GetInvInt 5874d9e Fix out of bound memory access in lppTransposer ========platform/external/chromium-webview between android-8.1.0_r2..android-8.1.0_r7========= e2cef60 Snap for 4448085 from 1323826a3aef844e0e4bcab50e37fe01f4163c66 to oc-m3-release ========platform/external/libavc between android-8.1.0_r2..android-8.1.0_r7========= decoder/ih264d_api.c | 26 ++++++++++++++++++++++---- decoder/ih264d_defs.h | 3 +++ decoder/ih264d_dpb_mgr.c | 2 +- decoder/ih264d_parse_headers.c | 14 ++++++++++++-- decoder/ih264d_parse_slice.c | 9 +++++++++ decoder/ih264d_sei.c | 7 ++++--- decoder/ih264d_structs.h | 1 + 7 files changed, 52 insertions(+), 10 deletions(-) 3e17d26 Decoder: Handle dec_hdl memory allocation failure gracefully e08b7d7 Decoder: Fixed incorrect use of mmco parameters. cb8d81f Decoder: Increased allocation and added checks in sei parsing. 6483b7c Decoder: Detect change of mbaff flag in SPS ========platform/external/libhevc between android-8.1.0_r2..android-8.1.0_r7========= common/arm/ihevc_deblk_chroma_horz.s | 16 ++- common/arm/ihevc_deblk_chroma_vert.s | 16 ++- common/arm/ihevc_deblk_luma_horz.s | 25 ++-- common/arm/ihevc_deblk_luma_vert.s | 21 ++-- common/arm/ihevc_inter_pred_chroma_copy.s | 7 +- common/arm/ihevc_inter_pred_chroma_copy_w16out.s | 13 ++- common/arm/ihevc_inter_pred_chroma_horz.s | 12 +- common/arm/ihevc_inter_pred_chroma_horz_w16out.s | 13 ++- common/arm/ihevc_inter_pred_chroma_vert.s | 13 ++- common/arm/ihevc_inter_pred_chroma_vert_w16inp.s | 13 ++- .../ihevc_inter_pred_chroma_vert_w16inp_w16out.s | 13 ++- common/arm/ihevc_inter_pred_chroma_vert_w16out.s | 12 +- common/arm/ihevc_inter_pred_filters_luma_horz.s | 25 ++-- common/arm/ihevc_inter_pred_filters_luma_vert.s | 30 +++-- .../ihevc_inter_pred_filters_luma_vert_w16inp.s | 12 +- common/arm/ihevc_inter_pred_luma_copy.s | 12 +- common/arm/ihevc_inter_pred_luma_copy_w16out.s | 11 +- common/arm/ihevc_inter_pred_luma_horz_w16out.s | 35 +++--- .../arm/ihevc_inter_pred_luma_vert_w16inp_w16out.s | 12 +- common/arm/ihevc_intra_pred_chroma_dc.s | 4 +- common/arm/ihevc_intra_pred_chroma_horz.s | 9 +- common/arm/ihevc_intra_pred_chroma_mode2.s | 8 +- common/arm/ihevc_intra_pred_chroma_mode_18_34.s | 12 +- common/arm/ihevc_intra_pred_chroma_mode_27_to_33.s | 9 +- common/arm/ihevc_intra_pred_chroma_mode_3_to_9.s | 11 +- common/arm/ihevc_intra_pred_chroma_planar.s | 8 +- common/arm/ihevc_intra_pred_chroma_ver.s | 4 +- ...ihevc_intra_pred_filters_chroma_mode_11_to_17.s | 13 ++- ...ihevc_intra_pred_filters_chroma_mode_19_to_25.s | 13 ++- .../ihevc_intra_pred_filters_luma_mode_11_to_17.s | 14 ++- .../ihevc_intra_pred_filters_luma_mode_19_to_25.s | 13 ++- common/arm/ihevc_intra_pred_luma_dc.s | 9 +- common/arm/ihevc_intra_pred_luma_horz.s | 13 ++- common/arm/ihevc_intra_pred_luma_mode2.s | 9 +- common/arm/ihevc_intra_pred_luma_mode_18_34.s | 7 +- common/arm/ihevc_intra_pred_luma_mode_27_to_33.s | 10 +- common/arm/ihevc_intra_pred_luma_mode_3_to_9.s | 12 +- common/arm/ihevc_intra_pred_luma_planar.s | 9 +- common/arm/ihevc_intra_pred_luma_vert.s | 9 +- common/arm/ihevc_itrans_recon_16x16.s | 25 ++-- common/arm/ihevc_itrans_recon_32x32.s | 27 +++-- common/arm/ihevc_itrans_recon_4x4.s | 15 ++- common/arm/ihevc_itrans_recon_4x4_ttype1.s | 16 ++- common/arm/ihevc_itrans_recon_8x8.s | 18 ++- common/arm/ihevc_sao_band_offset_chroma.s | 24 ++-- common/arm/ihevc_sao_band_offset_luma.s | 18 ++- common/arm/ihevc_sao_edge_offset_class0.s | 21 +++- common/arm/ihevc_sao_edge_offset_class0_chroma.s | 24 +++- common/arm/ihevc_sao_edge_offset_class1.s | 21 +++- common/arm/ihevc_sao_edge_offset_class1_chroma.s | 24 ++-- common/arm/ihevc_sao_edge_offset_class2.s | 110 ++++++++++-------- common/arm/ihevc_sao_edge_offset_class2_chroma.s | 116 ++++++++++--------- common/arm/ihevc_sao_edge_offset_class3.s | 126 ++++++++++---------- common/arm/ihevc_sao_edge_offset_class3_chroma.s | 127 +++++++++++---------- common/arm/ihevc_weighted_pred_bi.s | 36 ++++-- common/arm/ihevc_weighted_pred_bi_default.s | 22 +++- common/arm/ihevc_weighted_pred_uni.s | 21 +++- decoder/ihevcd_api.c | 24 +++- decoder/ihevcd_decode.c | 22 ++-- decoder/ihevcd_parse_headers.c | 8 +- decoder/ihevcd_parse_slice.c | 40 ++++--- decoder/ihevcd_parse_slice_header.c | 25 ++-- 62 files changed, 909 insertions(+), 508 deletions(-) dc50681 Add PUSH-POP of D registers in Arm Neon 32 bit functions 5fd289f Fix first frame error return d2789c9 Return error for negative crop parameters 4613e01 Consume bytes for sps with unsupported resolution 29da90e Fix slice address zero for not first slice in pic 8ca583e Decoder: Handle ps_codec_obj memory allocation failure gracefully de0d515 Fix prev slice incomplete check 272663d Fix incomplete frame error ========platform/external/libmpeg2 between android-8.1.0_r2..android-8.1.0_r7========= decoder/impeg2d_dec_hdr.c | 5 +++++ decoder/impeg2d_pic_proc.c | 2 ++ 2 files changed, 7 insertions(+) 59e227c Adding Error Check for f_code Parameters ========platform/external/libvpx between android-8.1.0_r2..android-8.1.0_r7========= libvpx/vpx/src/vpx_image.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) 51c34f6 DO NOT MERGE | libvpx: Fix OOB caused by odd frame width. ========platform/frameworks/av between android-8.1.0_r2..android-8.1.0_r7========= drm/mediadrm/plugins/clearkey/AesCtrDecryptor.cpp | 5 ++ drm/mediadrm/plugins/clearkey/AesCtrDecryptor.h | 1 + .../clearkey/tests/AesCtrDecryptorUnittest.cpp | 63 +++++++++++++- .../libeffects/lvm/wrapper/Reverb/EffectReverb.cpp | 4 + media/libmediaplayerservice/MediaPlayerService.cpp | 98 +++++++++++++--------- media/libmediaplayerservice/MediaPlayerService.h | 6 +- .../libmediaplayerservice/MediaRecorderClient.cpp | 6 +- media/libmediaplayerservice/MediaRecorderClient.h | 2 +- media/libstagefright/ACodec.cpp | 5 +- media/libstagefright/codecs/avcdec/SoftAVCDec.cpp | 10 +-- media/libstagefright/codecs/hevcdec/SoftHEVC.cpp | 8 +- media/libstagefright/id3/ID3.cpp | 7 +- 12 files changed, 154 insertions(+), 61 deletions(-) ab6913aff avoid 32-bit integer overflow a85824211 Access AVCDEC context after create fail check 9252d0f17 Access HEVC context after create fail check 5f9bf04c2 SoftAVCDec: Handle zero length input without EOS 986ace64b Add EFFECT_CMD_SET_PARAM parameter checking to Preset Reverb d2946aea7 Fix edge case when applying id3 unsynchronization e5e68bcce Validate decryption key length to decrypt function. 550736e7a Protect against possible race conditions ========platform/frameworks/base between android-8.1.0_r2..android-8.1.0_r7========= core/java/android/net/Uri.java | 6 +++--- core/jni/android/graphics/Bitmap.cpp | 2 ++ core/tests/coretests/src/android/net/UriTest.java | 5 +++++ media/jni/android_mtp_MtpDatabase.cpp | 1 + 4 files changed, 11 insertions(+), 3 deletions(-) 949c64bd704 Adjust Uri host parsing to use last instead of first @. c7673337fb3 Throw OOME if Bitmap.nativeCreate fails 5f773b766d2 mtp: fix double free of thumbnail data ========platform/frameworks/ex between android-8.1.0_r2..android-8.1.0_r7========= framesequence/jni/FrameSequence_gif.cpp | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) 0822ee4 Skip composition of frames lacking a color map ========platform/frameworks/native between android-8.1.0_r2..android-8.1.0_r7========= services/surfaceflinger/MessageQueue.cpp | 8 +++++++ services/surfaceflinger/SurfaceFlinger.cpp | 37 ++++++++++++++++++++++++------ services/surfaceflinger/SurfaceFlinger.h | 3 +++ 3 files changed, 41 insertions(+), 7 deletions(-) 00850f246 surfaceflinger: make vsync injection more robust ========platform/hardware/qcom/media between android-8.1.0_r2..android-8.1.0_r7========= .../mm-video-v4l2/vidc/venc/inc/omx_video_base.h | 4 ++ .../mm-video-v4l2/vidc/venc/src/omx_video_base.cpp | 55 ++++++++++++++++------ .../vidc/venc/src/omx_video_encoder.cpp | 19 +++++++- 3 files changed, 62 insertions(+), 16 deletions(-) a164ee8 mm-video-v4l2: venc: Squash below changes ========platform/prebuilts/abi-dumps/vndk between android-8.1.0_r2..android-8.1.0_r7========= 86719d0 Snap for 4448085 from a0ad82df9e4ceacfc60f7ebbf9779d3d92eeb773 to oc-m3-release ========platform/prebuilts/gcc/darwin-x86/aarch64/aarch64-linux-android-4.9 between android-8.1.0_r2..android-8.1.0_r7========= 9bcedff Snap for 4448085 from 91a0cf84baffc9808b93554451e149b12f2ad6d2 to oc-m3-release ========platform/prebuilts/gcc/darwin-x86/arm/arm-linux-androideabi-4.9 between android-8.1.0_r2..android-8.1.0_r7========= 7e13209 Snap for 4448085 from 20aadb937757fdff11c09010765f63c20ebb5042 to oc-m3-release ========platform/prebuilts/gcc/darwin-x86/x86/x86_64-linux-android-4.9 between android-8.1.0_r2..android-8.1.0_r7========= ad45af3 Snap for 4448085 from 4e41eb8af41e0ed06d8237a4de8c75e2c3698f79 to oc-m3-release ========platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9 between android-8.1.0_r2..android-8.1.0_r7========= f756ad1 Snap for 4448085 from c9c4fb77a024d2610f83e54e536c99a964ea85ab to oc-m3-release ========platform/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9 between android-8.1.0_r2..android-8.1.0_r7========= e3e6116 Snap for 4448085 from 43bf3bf040b873cb1334cdc0687a03d8d6f4b1c8 to oc-m3-release ========platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9 between android-8.1.0_r2..android-8.1.0_r7========= e3df713 Snap for 4448085 from a57c546eec04da569ddd24dd72b0d57feb95845a to oc-m3-release ========platform/prebuilts/gradle-plugin between android-8.1.0_r2..android-8.1.0_r7========= bfde7fca Snap for 4448085 from cd1b6806eae4eaa88d82ce61dbb7c2bcfea1f96a to oc-m3-release ========platform/prebuilts/maven_repo/android between android-8.1.0_r2..android-8.1.0_r7========= 5e15c3d9 Snap for 4448085 from c7fc1cdb67ff477e4ef1f7dee12568f223ea18c7 to oc-m3-release ========platform/prebuilts/ndk between android-8.1.0_r2..android-8.1.0_r7========= 4bef821a Snap for 4448085 from f39cb3e537ad90d4985fc372b339d466799d964e to oc-m3-release ========platform/prebuilts/qemu-kernel between android-8.1.0_r2..android-8.1.0_r7========= afe185e Snap for 4448085 from 87e7c6027290300bfb92c082c4fa622e78b03359 to oc-m3-release ========platform/prebuilts/sdk between android-8.1.0_r2..android-8.1.0_r7========= e06945e2 Snap for 4448085 from 692a2a62d5862258c6a88d3b9bfcbc1dd0431ae8 to oc-m3-release ========platform/prebuilts/tools between android-8.1.0_r2..android-8.1.0_r7========= c29c3a60 Snap for 4448085 from bd037f3696cc33196a876c34a7f5a0dcc6e089ee to oc-m3-release ========platform/system/core between android-8.1.0_r2..android-8.1.0_r7========= libnetutils/packet.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) de9802448 libnetutil: Check dhcp respose packet length ========platform/system/hwservicemanager between android-8.1.0_r2..android-8.1.0_r7========= AccessControl.cpp | 37 ++++++++++++++++++++++--------------- AccessControl.h | 12 +++++++++--- ServiceManager.cpp | 3 ++- 3 files changed, 33 insertions(+), 19 deletions(-) f7b5c7b get selinux context on add call arrival. ========platform/system/libhidl between android-8.1.0_r2..android-8.1.0_r7========= transport/HidlTransportUtils.cpp | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) df72fbd canCastInterface: always return true for IBase ========platform/system/media between android-8.1.0_r2..android-8.1.0_r7========= camera/src/camera_metadata.c | 6 ++++++ 1 file changed, 6 insertions(+) 2dea71fa Camera metadata: Check source metadata size ========platform/system/tools/hidl between android-8.1.0_r2..android-8.1.0_r7========= generateCpp.cpp | 4 ++++ 1 file changed, 4 insertions(+) a27cb79 Explicitly check processes are oneway