*************************************************************** *************************************************************** 54 file changed, 1021 insertions(+), 301 deletions(-) *************************************************************** *************************************************************** ========platform/build between android-8.1.0_r29..android-8.1.0_r33========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) d6071dcbe [DO NOT MERGE] Updating security string for oc-mr1-dev to 2018-06-05 Bug: 78240102 (cherry picked from commit 75164b086db2588093747047005fe2fe53820d3b) dd72b82aa Version bump to OPM6.171019.030 309f4dcd7 Update Security String to 05-05 on release branch (cherry picked from commit 15d6d5502cb5eb2b2054c8baecadccc4422854c9) 106847759 DO NOT MERGE Updating security string for oc-dev to 2018-05-01 ========device/asus/fugu-kernel between android-8.1.0_r29..android-8.1.0_r33========= 528b928 release-request-a84b3435-75fa-41e8-bd3c-ca0f4cbd5cc5-for-git_oc-m2-release-4352002 snap-temp-L88700000105039240 ========device/google/dragon-kernel between android-8.1.0_r29..android-8.1.0_r33========= 8b2f5e0 Merge cherrypicks of [3898937, 3898958, 3899077, 3897885, 3898496, 3898245, 3898959, 3898960, 3897790, 3898312, 3898313, 3898314, 3899155, 3899156, 3899157, 3898289, 3898290, 3899061, 3898291, 3898292, 3896951, 3899158, 3898961, 3898938, 3898246] into sparse-4657601-L30800000163316240 ========device/google/marlin-kernel between android-8.1.0_r29..android-8.1.0_r33========= Image.gz-dtb.kasan | Bin 17898043 -> 17898589 bytes Image.lz4-dtb | Bin 21032304 -> 21031778 bytes 2 files changed, 0 insertions(+), 0 deletions(-) 8daf811 Merge cherrypicks of [3898937, 3898958, 3899077, 3897885, 3898496, 3898245, 3898959, 3898960, 3897790, 3898312, 3898313, 3898314, 3899155, 3899156, 3899157, 3898289, 3898290, 3899061, 3898291, 3898292, 3896951, 3899158, 3898961, 3898938, 3898246] into sparse-4657601-L30800000163316240 ========device/google/wahoo between android-8.1.0_r29..android-8.1.0_r33========= 4fa5878 Update SVN to 9 for May Release bug: 74345861 (cherry picked from commit 294cd6b8d899ff28f13639abeaebc56e48e392e6) ========device/google/wahoo-kernel between android-8.1.0_r29..android-8.1.0_r33========= 5c636a9 Merge cherrypicks of [3898937, 3898958, 3899077, 3897885, 3898496, 3898245, 3898959, 3898960, 3897790, 3898312, 3898313, 3898314, 3899155, 3899156, 3899157, 3898289, 3898290, 3899061, 3898291, 3898292, 3896951, 3899158, 3898961, 3898938, 3898246] into sparse-4657601-L30800000163316240 ========device/huawei/angler-kernel between android-8.1.0_r29..android-8.1.0_r33========= Image.gz-dtb | Bin 11135530 -> 11136436 bytes 1 file changed, 0 insertions(+), 0 deletions(-) a32488f Merge cherrypicks of [4025538, 4025981, 4025580, 4024762, 4024763, 4025174, 4026015, 4026016, 4025704, 4025983, 4025597, 4025986, 4025988, 4025990, 4024386, 4024387, 4024388, 4024389, 4024390, 4024391, 4024392, 4024766, 4026038, 4024767, 4026039, 4026040, 4026041, 4026042, 4026043, 4026044, 4026045, 4026046, 4026047, 4026048, 4025720] into sparse-4749909-L37000000170952244 ========device/lge/bullhead-kernel between android-8.1.0_r29..android-8.1.0_r33========= Image.gz-dtb | Bin 10832335 -> 10826383 bytes 1 file changed, 0 insertions(+), 0 deletions(-) c3a3805 Merge cherrypicks of [4025538, 4025981, 4025580, 4024762, 4024763, 4025174, 4026015, 4026016, 4025704, 4025983, 4025597, 4025986, 4025988, 4025990, 4024386, 4024387, 4024388, 4024389, 4024390, 4024391, 4024392, 4024766, 4026038, 4024767, 4026039, 4026040, 4026041, 4026042, 4026043, 4026044, 4026045, 4026046, 4026047, 4026048, 4025720] into sparse-4749909-L37000000170952244 ========platform/external/chromium-webview between android-8.1.0_r29..android-8.1.0_r33========= 3ac458a Snap for 4417144 from 1323826a3aef844e0e4bcab50e37fe01f4163c66 to oc-m2-release ========platform/external/conscrypt between android-8.1.0_r29..android-8.1.0_r33========= 37a98e34 Fix SSLEngine bug with multiple heap buffer inputs. ========platform/external/libavc between android-8.1.0_r29..android-8.1.0_r33========= decoder/ih264d_dpb_mgr.c | 5 ++--- encoder/ih264e_api.c | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 3 deletions(-) a1511cc Encoder: Return error for odd resolution c138fdf Decoder: Modify setting short term reference field flag ========platform/external/libhevc between android-8.1.0_r29..android-8.1.0_r33========= decoder/ihevcd_parse_headers.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) 06a1f1e Return error for invalid sps sub layers parameters 1adc277 Add limits check for depth hierarchy sps parameters 37ecdc4 Return error for invalid reorder parameter ========platform/external/libmpeg2 between android-8.1.0_r29..android-8.1.0_r33========= decoder/impeg2d_pnb_pic.c | 5 +++++ 1 file changed, 5 insertions(+) 55afb9d Adding Check For Number of Skip MBs f1e1a3e Adding Internal Input Buffer ========platform/external/libvpx between android-8.1.0_r29..android-8.1.0_r33========= libvpx/vp8/encoder/mcomp.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) d412262 DO NOT MERGE | libvpx: cherry pick fix to OOB of mv_cost index. ========platform/external/sonivox between android-8.1.0_r29..android-8.1.0_r33========= arm-wt-22k/lib_src/eas_smf.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) 7cbb8e2 sonivox: fix hang caused by bad meta-event ========platform/frameworks/av between android-8.1.0_r29..android-8.1.0_r33========= media/libaudioclient/IAudioPolicyService.cpp | 65 +++++++++++++++++----- .../include/media/IAudioPolicyService.h | 2 + media/libstagefright/VideoFrameScheduler.cpp | 5 ++ .../common/managerdefinitions/src/AudioPort.cpp | 1 + 4 files changed, 59 insertions(+), 14 deletions(-) 9bb909f37 Sanitize effect descriptors for AudioPolicyService binder calls. f36bbc1ce Add check preventing div0 issue ab88b06ad Init gain config to prevent uninit leak. 5b5f81c36 fix crash due to no output format available -- DO NOT MERGE 4be50c578 Handle overflow in android::HeifDataSource::readAt cc33413ec better mpeg2 TS elementary stream Access Unit parsing 751895db1 Handle bad bitrate index in mp3dec. 6c06af898 heif: use width and height for decoder -- DO NOT MERGE ========platform/frameworks/base between android-8.1.0_r29..android-8.1.0_r33========= core/java/android/app/Activity.java | 10 ++ core/java/android/app/ActivityManagerInternal.java | 5 + core/java/android/app/assist/AssistStructure.java | 10 ++ core/java/android/os/Parcel.java | 15 +-- core/java/android/provider/MediaStore.java | 4 +- core/java/android/service/autofill/Dataset.java | 9 +- .../java/android/service/autofill/SaveRequest.java | 8 +- .../android/view/autofill/AutofillManager.java | 33 ++++++- .../android/view/autofill/IAutoFillManager.aidl | 6 +- libs/androidfw/ResourceTypes.cpp | 18 ++++ media/java/android/media/MediaScanner.java | 52 ---------- media/java/android/media/MiniThumbFile.java | 54 ++++++++++- proto/src/metrics_constants.proto | 13 +++ .../server/autofill/AutofillManagerService.java | 14 +-- .../autofill/AutofillManagerServiceImpl.java | 43 ++++++++- .../java/com/android/server/autofill/Session.java | 32 ++++--- .../android/server/am/ActivityManagerService.java | 20 ++++ .../android/server/pm/PackageManagerService.java | 105 +++++++++++++++++++++ 18 files changed, 352 insertions(+), 99 deletions(-) d08a8210844 DO NOT MERGE (O) Revoke permision when group changed 33a4e9f7c3d ResStringPool: Fix security vulnerability fe88b6028b7 Use concrete CREATOR instance for parceling lists 00ec414f868 Rework thumbnail cleanup 66fa94d42f3 DO NOT MERGE - fix AFM.getComponentNameFromContext() 160b70fa41f Proper autofill fix to let phone process autofill Settings activity. 6eb77633d9f Make sure apps cannot forge package name on AssistStructure used for Autofill. ed2ecd862b9 Fixed Security Vulnerability of DcParamObject a8620d213c5 Update internal ViewPager's SavedState to match Support Library version 69de8956fd5 [DO NOT MERGE] Copy PermissionChecker from support lib and use in RcognitionService 1326c6f3bf5 [DO NOT MERGE] Add permission check to setAllowOnlyVpnForUids f4064921b28 Verify last array's length in readFromParcel ========platform/frameworks/native between android-8.1.0_r29..android-8.1.0_r33========= include/input/InputTransport.h | 14 +--------- libs/input/InputTransport.cpp | 59 ++++++++++++++++-------------------------- 2 files changed, 24 insertions(+), 49 deletions(-) 8b1517ced Add bounds check to sensors direct channel creation ========platform/frameworks/opt/telephony between android-8.1.0_r29..android-8.1.0_r33========= .../internal/telephony/InboundSmsHandler.java | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) 75ffe6bf9 Fixed invalid pdu issue ========platform/hardware/interfaces between android-8.1.0_r29..android-8.1.0_r33========= cas/1.0/default/CasImpl.cpp | 81 +++++++++++++++++-------------------- cas/1.0/default/CasImpl.h | 2 +- cas/1.0/default/DescramblerImpl.cpp | 46 ++++++++++++++++----- cas/1.0/default/DescramblerImpl.h | 2 +- 4 files changed, 73 insertions(+), 58 deletions(-) e87f7e26 cas: fix UAF in descrambler -- DO NOT MERGE ========platform/libcore between android-8.1.0_r29..android-8.1.0_r33========= 6e907f5f3 DO NOT MERGE Add test for calling SSLEngine with multiple inputs. ========platform/packages/providers/MediaProvider between android-8.1.0_r29..android-8.1.0_r33========= src/com/android/providers/media/MediaProvider.java | 183 ++++++++++++++++++++- 1 file changed, 178 insertions(+), 5 deletions(-) 7775bbe Rework thumbnail cleanup ========platform/packages/providers/UserDictionaryProvider between android-8.1.0_r29..android-8.1.0_r33========= .../userdictionary/UserDictionaryProvider.java | 30 +++++++++++----------- 1 file changed, 15 insertions(+), 15 deletions(-) 2775693 Check caller before accessing database ========platform/packages/services/Telephony between android-8.1.0_r29..android-8.1.0_r33========= 59180002c Enhanced permission checks for TelephonyManager#endCall() API. ========platform/prebuilts/abi-dumps/vndk between android-8.1.0_r29..android-8.1.0_r33========= fad328a Snap for 4384531 from a0ad82df9e4ceacfc60f7ebbf9779d3d92eeb773 to oc-m2-release ========platform/prebuilts/gcc/darwin-x86/aarch64/aarch64-linux-android-4.9 between android-8.1.0_r29..android-8.1.0_r33========= e03deb5 Snap for 4384531 from 91a0cf84baffc9808b93554451e149b12f2ad6d2 to oc-m2-release ========platform/prebuilts/gcc/darwin-x86/arm/arm-linux-androideabi-4.9 between android-8.1.0_r29..android-8.1.0_r33========= f86db68 Snap for 4384531 from 20aadb937757fdff11c09010765f63c20ebb5042 to oc-m2-release ========platform/prebuilts/gcc/darwin-x86/x86/x86_64-linux-android-4.9 between android-8.1.0_r29..android-8.1.0_r33========= 576c22f Snap for 4384531 from 4e41eb8af41e0ed06d8237a4de8c75e2c3698f79 to oc-m2-release ========platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9 between android-8.1.0_r29..android-8.1.0_r33========= 7a28c22 Snap for 4384531 from c9c4fb77a024d2610f83e54e536c99a964ea85ab to oc-m2-release ========platform/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9 between android-8.1.0_r29..android-8.1.0_r33========= c348b64 Snap for 4384531 from 43bf3bf040b873cb1334cdc0687a03d8d6f4b1c8 to oc-m2-release ========platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9 between android-8.1.0_r29..android-8.1.0_r33========= ba87ed0 Snap for 4384531 from a57c546eec04da569ddd24dd72b0d57feb95845a to oc-m2-release ========platform/prebuilts/gradle-plugin between android-8.1.0_r29..android-8.1.0_r33========= 23dda331 Snap for 4384531 from cd1b6806eae4eaa88d82ce61dbb7c2bcfea1f96a to oc-m2-release ========platform/prebuilts/maven_repo/android between android-8.1.0_r29..android-8.1.0_r33========= f0fa9b95 Snap for 4384531 from c7fc1cdb67ff477e4ef1f7dee12568f223ea18c7 to oc-m2-release ========platform/prebuilts/ndk between android-8.1.0_r29..android-8.1.0_r33========= 3c28f681 Snap for 4384531 from f39cb3e537ad90d4985fc372b339d466799d964e to oc-m2-release ========platform/prebuilts/qemu-kernel between android-8.1.0_r29..android-8.1.0_r33========= 3d6df45 Snap for 4402310 from 87e7c6027290300bfb92c082c4fa622e78b03359 to oc-m2-release ========platform/prebuilts/sdk between android-8.1.0_r29..android-8.1.0_r33========= 8ba944d1 Snap for 4402310 from 692a2a62d5862258c6a88d3b9bfcbc1dd0431ae8 to oc-m2-release ========platform/prebuilts/tools between android-8.1.0_r29..android-8.1.0_r33========= a001fcbf release-request-99856c15-b008-4977-9971-f86523a23c0a-for-git_oc-m2-release-4367109 snap-temp-L18300000107415568 ========platform/system/bt between android-8.1.0_r29..android-8.1.0_r33========= bta/dm/bta_dm_act.cc | 21 +++++++--- bta/pan/bta_pan_act.cc | 34 +++++++-------- stack/bnep/bnep_api.cc | 9 ++++ stack/bnep/bnep_main.cc | 1 - stack/gatt/gatt_sr.cc | 29 ++++++++++--- stack/l2cap/l2c_fcr.cc | 22 ++++++++-- stack/l2cap/l2c_main.cc | 104 ++++++++++++++++++++++++++++++++++++++++++++++ stack/pan/pan_main.cc | 12 ++---- stack/smp/p_256_ecc_pp.cc | 22 ++++++++++ stack/smp/p_256_ecc_pp.h | 3 ++ stack/smp/smp_act.cc | 12 ++++++ 11 files changed, 226 insertions(+), 43 deletions(-) 8ce47dd6f DO NOT MERGE SMP: Validate remote elliptic curve points f0e808080 DO NOT MERGE Add bounds check for BNEP_Write 16a19010c DO NOT MERGE Initialize local variable in gatts_process_read_by_type_req f04019433 DO NOT MERGE Fix OOB read in process_l2cap_cmd 914ff2e13 PAN: Always allocate in bta_pan_data_buf_ind_cback c345851da DO NOT MERGE Handle bad packet length in gatts_process_read_req 0ce2d0bdc DO NOT MERGE Drop LE CoC fragments when frame size is too big f35f01f31 DO NOT MERGE Fix unexpected behavior in bta_dm_sdp_result ========platform/system/core between android-8.1.0_r29..android-8.1.0_r33========= 1ef9987ca String16: remove integer overflows