diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index 5c41d6c..9e0e194 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -18,7 +18,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
       package="com.android.cts.verifier"
       android:versionCode="5"
-      android:versionName="5.1_r23">
+      android:versionName="5.1_r24">
 
     <uses-sdk android:minSdkVersion="19" android:targetSdkVersion="21"/>
 
diff --git a/hostsidetests/appsecurity/test-apps/AppAccessData/src/com/android/cts/appaccessdata/AccessPrivateDataTest.java b/hostsidetests/appsecurity/test-apps/AppAccessData/src/com/android/cts/appaccessdata/AccessPrivateDataTest.java
index 40d3cff..db01dc3 100644
--- a/hostsidetests/appsecurity/test-apps/AppAccessData/src/com/android/cts/appaccessdata/AccessPrivateDataTest.java
+++ b/hostsidetests/appsecurity/test-apps/AppAccessData/src/com/android/cts/appaccessdata/AccessPrivateDataTest.java
@@ -104,14 +104,12 @@
             fail("Was not able to access another app's public file: " + e);
         }
 
-        boolean foundOtherStats = false;
         try {
             BufferedReader qtaguidReader = new BufferedReader(new FileReader("/proc/net/xt_qtaguid/stats"));
             String line;
             while ((line = qtaguidReader.readLine()) != null) {
                 String tokens[] = line.split(" ");
                 if (tokens.length > 3 && tokens[3].equals(String.valueOf(otherAppUid))) {
-                    foundOtherStats = true;
                     if (!tokens[2].equals("0x0")) {
                         fail("Other apps detailed traffic stats leaked");
                     }
@@ -121,6 +119,5 @@
         } catch (FileNotFoundException e) {
             fail("Was not able to access qtaguid/stats: " + e);
         }
-        assertTrue("Was expecting to find other apps' traffic stats", foundOtherStats);
     }
 }
diff --git a/tests/tests/content/Android.mk b/tests/tests/content/Android.mk
index 7da666a..52bedce 100644
--- a/tests/tests/content/Android.mk
+++ b/tests/tests/content/Android.mk
@@ -21,6 +21,9 @@
 # and when built explicitly put it in the data partition
 LOCAL_MODULE_PATH := $(TARGET_OUT_DATA_APPS)
 
+# Include both the 32 and 64 bit versions
+LOCAL_MULTILIB := both
+
 LOCAL_JNI_SHARED_LIBRARIES := libnativecursorwindow_jni libnativehelper_compat_libc++
 
 LOCAL_JAVA_LIBRARIES := android.test.runner
diff --git a/tests/tests/graphics/assets/ft45987.ttf b/tests/tests/graphics/assets/ft45987.ttf
new file mode 100644
index 0000000..369022f
--- /dev/null
+++ b/tests/tests/graphics/assets/ft45987.ttf
Binary files differ
diff --git a/tests/tests/graphics/assets/ft45987.ttf.README.txt b/tests/tests/graphics/assets/ft45987.ttf.README.txt
new file mode 100644
index 0000000..7586955
--- /dev/null
+++ b/tests/tests/graphics/assets/ft45987.ttf.README.txt
@@ -0,0 +1,4 @@
+ft45987.ttf was automatically generated by LibFuzzer
+(http://llvm.org/docs/LibFuzzer.html). Its base64 encoded version was taken
+from http://savannah.nongnu.org/bugs/?func=detailitem&item_id=45987 and
+decoded back.
diff --git a/tests/tests/graphics/assets/unsorted_cmap12.ttf b/tests/tests/graphics/assets/unsorted_cmap12.ttf
new file mode 100644
index 0000000..d9587df
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap12.ttf
Binary files differ
diff --git a/tests/tests/graphics/assets/unsorted_cmap12.ttx b/tests/tests/graphics/assets/unsorted_cmap12.ttx
new file mode 100644
index 0000000..6444903
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap12.ttx
@@ -0,0 +1,199 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<ttFont sfntVersion="\x00\x01\x00\x00" ttLibVersion="3.0">
+
+  <GlyphOrder>
+    <GlyphID id="0" name=".notdef"/>
+    <GlyphID id="1" name="3em"/>
+  </GlyphOrder>
+
+  <head>
+    <tableVersion value="1.0"/>
+    <fontRevision value="1.0"/>
+    <checkSumAdjustment value="0x640cdb2f"/>
+    <magicNumber value="0x5f0f3cf5"/>
+    <flags value="00000000 00000011"/>
+    <unitsPerEm value="1000"/>
+    <created value="Fri Mar 17 07:26:00 2017"/>
+    <macStyle value="00000000 00000000"/>
+    <lowestRecPPEM value="7"/>
+    <fontDirectionHint value="2"/>
+    <glyphDataFormat value="0"/>
+  </head>
+
+  <hhea>
+    <tableVersion value="0x00010000"/>
+    <ascent value="1000"/>
+    <descent value="-200"/>
+    <lineGap value="0"/>
+    <caretSlopeRise value="1"/>
+    <caretSlopeRun value="0"/>
+    <caretOffset value="0"/>
+    <reserved0 value="0"/>
+    <reserved1 value="0"/>
+    <reserved2 value="0"/>
+    <reserved3 value="0"/>
+    <metricDataFormat value="0"/>
+  </hhea>
+
+  <maxp>
+    <tableVersion value="0x10000"/>
+    <maxZones value="0"/>
+    <maxTwilightPoints value="0"/>
+    <maxStorage value="0"/>
+    <maxFunctionDefs value="0"/>
+    <maxInstructionDefs value="0"/>
+    <maxStackElements value="0"/>
+    <maxSizeOfInstructions value="0"/>
+    <maxComponentElements value="0"/>
+  </maxp>
+
+  <OS_2>
+    <!-- The fields 'usFirstCharIndex' and 'usLastCharIndex'
+         will be recalculated by the compiler -->
+    <version value="3"/>
+    <xAvgCharWidth value="594"/>
+    <usWeightClass value="400"/>
+    <usWidthClass value="5"/>
+    <fsType value="00000000 00001000"/>
+    <ySubscriptXSize value="650"/>
+    <ySubscriptYSize value="600"/>
+    <ySubscriptXOffset value="0"/>
+    <ySubscriptYOffset value="75"/>
+    <ySuperscriptXSize value="650"/>
+    <ySuperscriptYSize value="600"/>
+    <ySuperscriptXOffset value="0"/>
+    <ySuperscriptYOffset value="350"/>
+    <yStrikeoutSize value="50"/>
+    <yStrikeoutPosition value="300"/>
+    <sFamilyClass value="0"/>
+    <panose>
+      <bFamilyType value="0"/>
+      <bSerifStyle value="0"/>
+      <bWeight value="5"/>
+      <bProportion value="0"/>
+      <bContrast value="0"/>
+      <bStrokeVariation value="0"/>
+      <bArmStyle value="0"/>
+      <bLetterForm value="0"/>
+      <bMidline value="0"/>
+      <bXHeight value="0"/>
+    </panose>
+    <ulUnicodeRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulUnicodeRange2 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange3 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange4 value="00000000 00000000 00000000 00000000"/>
+    <achVendID value="UKWN"/>
+    <fsSelection value="00000000 01000000"/>
+    <usFirstCharIndex value="32"/>
+    <usLastCharIndex value="122"/>
+    <sTypoAscender value="800"/>
+    <sTypoDescender value="-200"/>
+    <sTypoLineGap value="200"/>
+    <usWinAscent value="1000"/>
+    <usWinDescent value="200"/>
+    <ulCodePageRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulCodePageRange2 value="00000000 00000000 00000000 00000000"/>
+    <sxHeight value="500"/>
+    <sCapHeight value="700"/>
+    <usDefaultChar value="0"/>
+    <usBreakChar value="32"/>
+    <usMaxContext value="0"/>
+  </OS_2>
+
+  <hmtx>
+    <mtx name=".notdef" width="500" lsb="93"/>
+    <mtx name="3em" width="3000" lsb="93"/>
+  </hmtx>
+
+  <cmap>
+    <tableVersion version="0"/>
+    <cmap_format_12 format="12" reserved="0" length="0" nGroups="0" platformID="3" platEncID="10" language="0">
+      <!-- Note that following hexcode is pseudo ttx source.
+           You may want to see hexdump of the unsorted_cmap12.ttf -->
+      <hexdata>
+        00 0c  <!-- format: 12 -->
+        00 00  <!-- reserved -->
+        00 00 00 28  <!-- length: 40 bytes -->
+        00 00 00 00  <!-- langauge -->
+        00 00 00 02  <!-- num of groups -->
+
+        <!-- Bad font: cmap entries must be sorted in ascending order. -->
+        <!-- start of the first group -->
+        00 00 04 00  <!-- start code point -->
+        00 00 04 00  <!-- end code point -->
+        00 00 00 01  <!-- start glyph ID -->
+
+        <!-- start of the second group -->
+        00 00 01 00  <!-- start code point -->
+        00 00 01 00  <!-- end code point -->
+        00 00 00 01  <!-- start glyph ID -->
+      </hexdata>
+    </cmap_format_12>
+  </cmap>
+
+  <loca>
+    <!-- The 'loca' table will be calculated by the compiler -->
+  </loca>
+
+  <glyf>
+    <TTGlyph name=".notdef" xMin="0" yMin="0" xMax="0" yMax="0" />
+    <TTGlyph name="3em" xMin="0" yMin="0" xMax="0" yMax="0" />
+  </glyf>
+
+  <name>
+    <namerecord nameID="0" platformID="3" platEncID="1" langID="0x409">
+      Copyright (C) 2017 The Android Open Source Project
+    </namerecord>
+    <namerecord nameID="1" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format12 Font
+    </namerecord>
+    <namerecord nameID="2" platformID="3" platEncID="1" langID="0x409">
+      Regular
+    </namerecord>
+    <namerecord nameID="4" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format12 Font
+    </namerecord>
+    <namerecord nameID="6" platformID="3" platEncID="1" langID="0x409">
+      BrokenCmapFormat12Font-Regular
+    </namerecord>
+    <namerecord nameID="13" platformID="3" platEncID="1" langID="0x409">
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+    </namerecord>
+    <namerecord nameID="14" platformID="3" platEncID="1" langID="0x409">
+      http://www.apache.org/licenses/LICENSE-2.0
+    </namerecord>
+  </name>
+
+  <post>
+    <formatType value="3.0"/>
+    <italicAngle value="0.0"/>
+    <underlinePosition value="-75"/>
+    <underlineThickness value="50"/>
+    <isFixedPitch value="0"/>
+    <minMemType42 value="0"/>
+    <maxMemType42 value="0"/>
+    <minMemType1 value="0"/>
+    <maxMemType1 value="0"/>
+  </post>
+
+</ttFont>
diff --git a/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttf b/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttf
new file mode 100644
index 0000000..83801fc
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttf
Binary files differ
diff --git a/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttx b/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttx
new file mode 100644
index 0000000..310a487
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap14_default_uvs.ttx
@@ -0,0 +1,197 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<ttFont sfntVersion="\x00\x01\x00\x00" ttLibVersion="3.0">
+
+  <GlyphOrder>
+    <GlyphID id="0" name=".notdef"/>
+  </GlyphOrder>
+
+  <head>
+    <tableVersion value="1.0"/>
+    <fontRevision value="1.0"/>
+    <checkSumAdjustment value="0x640cdb2f"/>
+    <magicNumber value="0x5f0f3cf5"/>
+    <flags value="00000000 00000011"/>
+    <unitsPerEm value="1000"/>
+    <created value="Fri Mar 17 07:26:00 2017"/>
+    <macStyle value="00000000 00000000"/>
+    <lowestRecPPEM value="7"/>
+    <fontDirectionHint value="2"/>
+    <glyphDataFormat value="0"/>
+  </head>
+
+  <hhea>
+    <tableVersion value="0x00010000"/>
+    <ascent value="1000"/>
+    <descent value="-200"/>
+    <lineGap value="0"/>
+    <caretSlopeRise value="1"/>
+    <caretSlopeRun value="0"/>
+    <caretOffset value="0"/>
+    <reserved0 value="0"/>
+    <reserved1 value="0"/>
+    <reserved2 value="0"/>
+    <reserved3 value="0"/>
+    <metricDataFormat value="0"/>
+  </hhea>
+
+  <maxp>
+    <tableVersion value="0x10000"/>
+    <maxZones value="0"/>
+    <maxTwilightPoints value="0"/>
+    <maxStorage value="0"/>
+    <maxFunctionDefs value="0"/>
+    <maxInstructionDefs value="0"/>
+    <maxStackElements value="0"/>
+    <maxSizeOfInstructions value="0"/>
+    <maxComponentElements value="0"/>
+  </maxp>
+
+  <OS_2>
+    <!-- The fields 'usFirstCharIndex' and 'usLastCharIndex'
+         will be recalculated by the compiler -->
+    <version value="3"/>
+    <xAvgCharWidth value="594"/>
+    <usWeightClass value="400"/>
+    <usWidthClass value="5"/>
+    <fsType value="00000000 00001000"/>
+    <ySubscriptXSize value="650"/>
+    <ySubscriptYSize value="600"/>
+    <ySubscriptXOffset value="0"/>
+    <ySubscriptYOffset value="75"/>
+    <ySuperscriptXSize value="650"/>
+    <ySuperscriptYSize value="600"/>
+    <ySuperscriptXOffset value="0"/>
+    <ySuperscriptYOffset value="350"/>
+    <yStrikeoutSize value="50"/>
+    <yStrikeoutPosition value="300"/>
+    <sFamilyClass value="0"/>
+    <panose>
+      <bFamilyType value="0"/>
+      <bSerifStyle value="0"/>
+      <bWeight value="5"/>
+      <bProportion value="0"/>
+      <bContrast value="0"/>
+      <bStrokeVariation value="0"/>
+      <bArmStyle value="0"/>
+      <bLetterForm value="0"/>
+      <bMidline value="0"/>
+      <bXHeight value="0"/>
+    </panose>
+    <ulUnicodeRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulUnicodeRange2 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange3 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange4 value="00000000 00000000 00000000 00000000"/>
+    <achVendID value="UKWN"/>
+    <fsSelection value="00000000 01000000"/>
+    <usFirstCharIndex value="32"/>
+    <usLastCharIndex value="122"/>
+    <sTypoAscender value="800"/>
+    <sTypoDescender value="-200"/>
+    <sTypoLineGap value="200"/>
+    <usWinAscent value="1000"/>
+    <usWinDescent value="200"/>
+    <ulCodePageRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulCodePageRange2 value="00000000 00000000 00000000 00000000"/>
+    <sxHeight value="500"/>
+    <sCapHeight value="700"/>
+    <usDefaultChar value="0"/>
+    <usBreakChar value="32"/>
+    <usMaxContext value="0"/>
+  </OS_2>
+
+  <hmtx>
+    <mtx name=".notdef" width="500" lsb="93"/>
+  </hmtx>
+
+  <cmap>
+    <tableVersion version="0"/>
+    <cmap_format_14 format="14" platformID="0" platEncID="5" length="0" numVarSelectorRecords="1">
+      <!-- Note that following hexcode is pseudo ttx source.
+           You may want to see hexdump of the unsorted_cmap14_default_uvs.ttf -->
+      <hexdata>
+        00 0e  <!-- format: 14 -->
+        00 00 00 21  <!-- length: 33 bytes -->
+        00 00 00 01  <!-- number of variation selectors -->
+
+        <!-- 1st variation selector record -->
+        00 fe 00  <!-- variation selector -->
+        00 00 00 15  <!-- the offset to the default UVS table -->
+        00 00 00 00  <!-- the offset to the non default UVS table (no table) -->
+
+        <!-- start of default UVS table -->
+        00 00 00 02  <!-- number of range record -->
+
+        <!-- Bad font: cmap entries must be sorted in ascending order. -->
+        00 04 00  <!-- Unicode code point. -->
+        00  <!-- number of additional following code points -->
+        00 01 00  <!-- Unicode code point. -->
+        00  <!-- number of additional following code points -->
+      </hexdata>
+    </cmap_format_14>
+  </cmap>
+
+  <loca>
+    <!-- The 'loca' table will be calculated by the compiler -->
+  </loca>
+
+  <glyf>
+    <TTGlyph name=".notdef" xMin="0" yMin="0" xMax="0" yMax="0" />
+  </glyf>
+
+  <name>
+    <namerecord nameID="0" platformID="3" platEncID="1" langID="0x409">
+      Copyright (C) 2017 The Android Open Source Project
+    </namerecord>
+    <namerecord nameID="1" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format14 Default UVS Table Font
+    </namerecord>
+    <namerecord nameID="2" platformID="3" platEncID="1" langID="0x409">
+      Regular
+    </namerecord>
+    <namerecord nameID="4" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format14 Default UVS Table Font
+    </namerecord>
+    <namerecord nameID="6" platformID="3" platEncID="1" langID="0x409">
+      BrokenCmapFormat14DefaultUVSTableFont-Regular
+    </namerecord>
+    <namerecord nameID="13" platformID="3" platEncID="1" langID="0x409">
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+    </namerecord>
+    <namerecord nameID="14" platformID="3" platEncID="1" langID="0x409">
+      http://www.apache.org/licenses/LICENSE-2.0
+    </namerecord>
+  </name>
+
+  <post>
+    <formatType value="3.0"/>
+    <italicAngle value="0.0"/>
+    <underlinePosition value="-75"/>
+    <underlineThickness value="50"/>
+    <isFixedPitch value="0"/>
+    <minMemType42 value="0"/>
+    <maxMemType42 value="0"/>
+    <minMemType1 value="0"/>
+    <maxMemType1 value="0"/>
+  </post>
+
+</ttFont>
diff --git a/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttf b/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttf
new file mode 100644
index 0000000..92aadc2
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttf
Binary files differ
diff --git a/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttx b/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttx
new file mode 100644
index 0000000..0c0cb77
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap14_non_default_uvs.ttx
@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<ttFont sfntVersion="\x00\x01\x00\x00" ttLibVersion="3.0">
+
+  <GlyphOrder>
+    <GlyphID id="0" name=".notdef"/>
+    <GlyphID id="1" name="3em"/>
+  </GlyphOrder>
+
+  <head>
+    <tableVersion value="1.0"/>
+    <fontRevision value="1.0"/>
+    <checkSumAdjustment value="0x640cdb2f"/>
+    <magicNumber value="0x5f0f3cf5"/>
+    <flags value="00000000 00000011"/>
+    <unitsPerEm value="1000"/>
+    <created value="Fri Mar 17 07:26:00 2017"/>
+    <macStyle value="00000000 00000000"/>
+    <lowestRecPPEM value="7"/>
+    <fontDirectionHint value="2"/>
+    <glyphDataFormat value="0"/>
+  </head>
+
+  <hhea>
+    <tableVersion value="0x00010000"/>
+    <ascent value="1000"/>
+    <descent value="-200"/>
+    <lineGap value="0"/>
+    <caretSlopeRise value="1"/>
+    <caretSlopeRun value="0"/>
+    <caretOffset value="0"/>
+    <reserved0 value="0"/>
+    <reserved1 value="0"/>
+    <reserved2 value="0"/>
+    <reserved3 value="0"/>
+    <metricDataFormat value="0"/>
+  </hhea>
+
+  <maxp>
+    <tableVersion value="0x10000"/>
+    <maxZones value="0"/>
+    <maxTwilightPoints value="0"/>
+    <maxStorage value="0"/>
+    <maxFunctionDefs value="0"/>
+    <maxInstructionDefs value="0"/>
+    <maxStackElements value="0"/>
+    <maxSizeOfInstructions value="0"/>
+    <maxComponentElements value="0"/>
+  </maxp>
+
+  <OS_2>
+    <!-- The fields 'usFirstCharIndex' and 'usLastCharIndex'
+         will be recalculated by the compiler -->
+    <version value="3"/>
+    <xAvgCharWidth value="594"/>
+    <usWeightClass value="400"/>
+    <usWidthClass value="5"/>
+    <fsType value="00000000 00001000"/>
+    <ySubscriptXSize value="650"/>
+    <ySubscriptYSize value="600"/>
+    <ySubscriptXOffset value="0"/>
+    <ySubscriptYOffset value="75"/>
+    <ySuperscriptXSize value="650"/>
+    <ySuperscriptYSize value="600"/>
+    <ySuperscriptXOffset value="0"/>
+    <ySuperscriptYOffset value="350"/>
+    <yStrikeoutSize value="50"/>
+    <yStrikeoutPosition value="300"/>
+    <sFamilyClass value="0"/>
+    <panose>
+      <bFamilyType value="0"/>
+      <bSerifStyle value="0"/>
+      <bWeight value="5"/>
+      <bProportion value="0"/>
+      <bContrast value="0"/>
+      <bStrokeVariation value="0"/>
+      <bArmStyle value="0"/>
+      <bLetterForm value="0"/>
+      <bMidline value="0"/>
+      <bXHeight value="0"/>
+    </panose>
+    <ulUnicodeRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulUnicodeRange2 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange3 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange4 value="00000000 00000000 00000000 00000000"/>
+    <achVendID value="UKWN"/>
+    <fsSelection value="00000000 01000000"/>
+    <usFirstCharIndex value="32"/>
+    <usLastCharIndex value="122"/>
+    <sTypoAscender value="800"/>
+    <sTypoDescender value="-200"/>
+    <sTypoLineGap value="200"/>
+    <usWinAscent value="1000"/>
+    <usWinDescent value="200"/>
+    <ulCodePageRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulCodePageRange2 value="00000000 00000000 00000000 00000000"/>
+    <sxHeight value="500"/>
+    <sCapHeight value="700"/>
+    <usDefaultChar value="0"/>
+    <usBreakChar value="32"/>
+    <usMaxContext value="0"/>
+  </OS_2>
+
+  <hmtx>
+    <mtx name=".notdef" width="500" lsb="93"/>
+    <mtx name="3em" width="3000" lsb="93"/>
+  </hmtx>
+
+  <cmap>
+    <tableVersion version="0"/>
+    <cmap_format_14 format="14" platformID="0" platEncID="5" length="0" numVarSelectorRecords="1">
+      <!-- Note that following hexcode is pseudo ttx source.
+           You may want to see hexdump of the unsorted_cmap14_non_default_uvs.ttf -->
+      <hexdata>
+        00 0e <!-- format: 14 -->
+        00 00 00 23  <!-- length: 35 bytes -->
+        00 00 00 01  <!-- number of variation selectors -->
+
+        <!-- 1st variation selector record -->
+        00 fe 00  <!-- variation selector -->
+        00 00 00 00  <!-- the offset to the default UVS table (no table) -->
+        00 00 00 15  <!-- the offset to the non default UVS table -->
+
+        <!-- start of default UVS table -->
+        00 00 00 02  <!-- number of mapping record -->
+
+        <!-- Bad font: cmap entries must be sorted in ascending order. -->
+        00 04 00  <!-- Unicode code point. -->
+        00 01  <!-- glyph ID -->
+        00 01 00  <!-- Unicode code point. -->
+        00 01  <!-- glyph ID -->
+      </hexdata>
+    </cmap_format_14>
+  </cmap>
+
+  <loca>
+    <!-- The 'loca' table will be calculated by the compiler -->
+  </loca>
+
+  <glyf>
+    <TTGlyph name=".notdef" xMin="0" yMin="0" xMax="0" yMax="0" />
+    <TTGlyph name="3em" xMin="0" yMin="0" xMax="0" yMax="0" />
+  </glyf>
+
+  <name>
+    <namerecord nameID="0" platformID="3" platEncID="1" langID="0x409">
+      Copyright (C) 2017 The Android Open Source Project
+    </namerecord>
+    <namerecord nameID="1" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format14 Non-Default UVS Table Font
+    </namerecord>
+    <namerecord nameID="2" platformID="3" platEncID="1" langID="0x409">
+      Regular
+    </namerecord>
+    <namerecord nameID="4" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format14 Non-Default UVS Table Font
+    </namerecord>
+    <namerecord nameID="6" platformID="3" platEncID="1" langID="0x409">
+      BrokenCmapFormat14NonDefaultUVSTableFont-Regular
+    </namerecord>
+    <namerecord nameID="13" platformID="3" platEncID="1" langID="0x409">
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+    </namerecord>
+    <namerecord nameID="14" platformID="3" platEncID="1" langID="0x409">
+      http://www.apache.org/licenses/LICENSE-2.0
+    </namerecord>
+  </name>
+
+  <post>
+    <formatType value="3.0"/>
+    <italicAngle value="0.0"/>
+    <underlinePosition value="-75"/>
+    <underlineThickness value="50"/>
+    <isFixedPitch value="0"/>
+    <minMemType42 value="0"/>
+    <maxMemType42 value="0"/>
+    <minMemType1 value="0"/>
+    <maxMemType1 value="0"/>
+  </post>
+
+</ttFont>
diff --git a/tests/tests/graphics/assets/unsorted_cmap4.ttf b/tests/tests/graphics/assets/unsorted_cmap4.ttf
new file mode 100644
index 0000000..8ceeb4e
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap4.ttf
Binary files differ
diff --git a/tests/tests/graphics/assets/unsorted_cmap4.ttx b/tests/tests/graphics/assets/unsorted_cmap4.ttx
new file mode 100644
index 0000000..8b16955
--- /dev/null
+++ b/tests/tests/graphics/assets/unsorted_cmap4.ttx
@@ -0,0 +1,197 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<ttFont sfntVersion="\x00\x01\x00\x00" ttLibVersion="3.0">
+
+  <GlyphOrder>
+    <GlyphID id="0" name=".notdef"/>
+    <GlyphID id="1" name="3em"/>
+  </GlyphOrder>
+
+  <head>
+    <tableVersion value="1.0"/>
+    <fontRevision value="1.0"/>
+    <checkSumAdjustment value="0x640cdb2f"/>
+    <magicNumber value="0x5f0f3cf5"/>
+    <flags value="00000000 00000011"/>
+    <unitsPerEm value="1000"/>
+    <created value="Fri Mar 17 07:26:00 2017"/>
+    <macStyle value="00000000 00000000"/>
+    <lowestRecPPEM value="7"/>
+    <fontDirectionHint value="2"/>
+    <glyphDataFormat value="0"/>
+  </head>
+
+  <hhea>
+    <tableVersion value="0x00010000"/>
+    <ascent value="1000"/>
+    <descent value="-200"/>
+    <lineGap value="0"/>
+    <caretSlopeRise value="1"/>
+    <caretSlopeRun value="0"/>
+    <caretOffset value="0"/>
+    <reserved0 value="0"/>
+    <reserved1 value="0"/>
+    <reserved2 value="0"/>
+    <reserved3 value="0"/>
+    <metricDataFormat value="0"/>
+  </hhea>
+
+  <maxp>
+    <tableVersion value="0x10000"/>
+    <maxZones value="0"/>
+    <maxTwilightPoints value="0"/>
+    <maxStorage value="0"/>
+    <maxFunctionDefs value="0"/>
+    <maxInstructionDefs value="0"/>
+    <maxStackElements value="0"/>
+    <maxSizeOfInstructions value="0"/>
+    <maxComponentElements value="0"/>
+  </maxp>
+
+  <OS_2>
+    <!-- The fields 'usFirstCharIndex' and 'usLastCharIndex'
+         will be recalculated by the compiler -->
+    <version value="3"/>
+    <xAvgCharWidth value="594"/>
+    <usWeightClass value="400"/>
+    <usWidthClass value="5"/>
+    <fsType value="00000000 00001000"/>
+    <ySubscriptXSize value="650"/>
+    <ySubscriptYSize value="600"/>
+    <ySubscriptXOffset value="0"/>
+    <ySubscriptYOffset value="75"/>
+    <ySuperscriptXSize value="650"/>
+    <ySuperscriptYSize value="600"/>
+    <ySuperscriptXOffset value="0"/>
+    <ySuperscriptYOffset value="350"/>
+    <yStrikeoutSize value="50"/>
+    <yStrikeoutPosition value="300"/>
+    <sFamilyClass value="0"/>
+    <panose>
+      <bFamilyType value="0"/>
+      <bSerifStyle value="0"/>
+      <bWeight value="5"/>
+      <bProportion value="0"/>
+      <bContrast value="0"/>
+      <bStrokeVariation value="0"/>
+      <bArmStyle value="0"/>
+      <bLetterForm value="0"/>
+      <bMidline value="0"/>
+      <bXHeight value="0"/>
+    </panose>
+    <ulUnicodeRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulUnicodeRange2 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange3 value="00000000 00000000 00000000 00000000"/>
+    <ulUnicodeRange4 value="00000000 00000000 00000000 00000000"/>
+    <achVendID value="UKWN"/>
+    <fsSelection value="00000000 01000000"/>
+    <usFirstCharIndex value="32"/>
+    <usLastCharIndex value="122"/>
+    <sTypoAscender value="800"/>
+    <sTypoDescender value="-200"/>
+    <sTypoLineGap value="200"/>
+    <usWinAscent value="1000"/>
+    <usWinDescent value="200"/>
+    <ulCodePageRange1 value="00000000 00000000 00000000 00000001"/>
+    <ulCodePageRange2 value="00000000 00000000 00000000 00000000"/>
+    <sxHeight value="500"/>
+    <sCapHeight value="700"/>
+    <usDefaultChar value="0"/>
+    <usBreakChar value="32"/>
+    <usMaxContext value="0"/>
+  </OS_2>
+
+  <hmtx>
+    <mtx name=".notdef" width="500" lsb="93"/>
+    <mtx name="3em" width="3000" lsb="93"/>
+  </hmtx>
+
+  <cmap>
+    <tableVersion version="0"/>
+    <cmap_format_4 platformID="3" platEncID="10" language="0">
+      <!-- Note that following hexcode is pseudo ttx source.
+           You may want to see hexdump of the unsorted_cmap4.ttf -->
+      <hexdata>
+        00 04  <!-- format: 4 -->
+        00 28  <!-- length: 40 bytes -->
+        00 00  <!-- language -->
+        00 06  <!-- segment count -->
+        00 04  <!-- search range -->
+        00 01  <!-- entry selector -->
+        00 02  <!-- range shift -->
+
+        <!-- Bad font: cmap entries must be sorted in ascending order. -->
+        04 00 01 00 ff ff  <!-- end code points -->
+        00 00  <!-- reserved -->
+        04 00 01 00 ff ff  <!-- start code points -->
+        ff 01 fc 01 00 01  <!-- delta to glyph ID -->
+        00 00 00 00 00 00  <!-- glyph ID range offset -->
+      </hexdata>
+    </cmap_format_4>
+  </cmap>
+
+  <loca>
+    <!-- The 'loca' table will be calculated by the compiler -->
+  </loca>
+
+  <glyf>
+    <TTGlyph name=".notdef" xMin="0" yMin="0" xMax="0" yMax="0" />
+    <TTGlyph name="3em" xMin="0" yMin="0" xMax="0" yMax="0" />
+  </glyf>
+
+  <name>
+    <namerecord nameID="0" platformID="3" platEncID="1" langID="0x409">
+      Copyright (C) 2017 The Android Open Source Project
+    </namerecord>
+    <namerecord nameID="1" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format4 Font
+    </namerecord>
+    <namerecord nameID="2" platformID="3" platEncID="1" langID="0x409">
+      Regular
+    </namerecord>
+    <namerecord nameID="4" platformID="3" platEncID="1" langID="0x409">
+      Broken Cmap Format4 Font
+    </namerecord>
+    <namerecord nameID="6" platformID="3" platEncID="1" langID="0x409">
+      BrokenCmapFormat4Font-Regular
+    </namerecord>
+    <namerecord nameID="13" platformID="3" platEncID="1" langID="0x409">
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+    </namerecord>
+    <namerecord nameID="14" platformID="3" platEncID="1" langID="0x409">
+      http://www.apache.org/licenses/LICENSE-2.0
+    </namerecord>
+  </name>
+
+  <post>
+    <formatType value="3.0"/>
+    <italicAngle value="0.0"/>
+    <underlinePosition value="-75"/>
+    <underlineThickness value="50"/>
+    <isFixedPitch value="0"/>
+    <minMemType42 value="0"/>
+    <maxMemType42 value="0"/>
+    <minMemType1 value="0"/>
+    <maxMemType1 value="0"/>
+  </post>
+
+</ttFont>
diff --git a/tests/tests/graphics/src/android/graphics/cts/TypefaceTest.java b/tests/tests/graphics/src/android/graphics/cts/TypefaceTest.java
index 5528372..8724355 100644
--- a/tests/tests/graphics/src/android/graphics/cts/TypefaceTest.java
+++ b/tests/tests/graphics/src/android/graphics/cts/TypefaceTest.java
@@ -203,4 +203,36 @@
         float widthCustomTypeface = p.measureText(testString);
         assertEquals(widthDefaultTypeface, widthCustomTypeface, 1.0f);
     }
+
+    public void testBadFont() {
+        Typeface typeface = Typeface.createFromAsset(getContext().getAssets(), "ft45987.ttf");
+        assertNotNull(typeface);
+    }
+
+    public void testInvalidCmapFont_unsortedEntries() {
+        // Following two font files have glyph for U+0400 and U+0100 but the fonts must not be used
+        // due to invalid cmap data. For more details, see each ttx source file.
+        final String[] INVALID_CMAP_FONTS = { "unsorted_cmap4.ttf", "unsorted_cmap12.ttf" };
+        for (final String file : INVALID_CMAP_FONTS) {
+            final Typeface typeface = Typeface.createFromAsset(mContext.getAssets(), file);
+            assertNotNull(typeface);
+            final Paint p = new Paint();
+            final String testString = "\u0100\u0400";
+            final float widthDefaultTypeface = p.measureText(testString);
+            p.setTypeface(typeface);
+            final float widthCustomTypeface = p.measureText(testString);
+            assertEquals(widthDefaultTypeface, widthCustomTypeface, 0.0f);
+        }
+
+        // Following two font files have glyph for U+0400 U+FE00 and U+0100 U+FE00 but the fonts
+        // must not be used due to invalid cmap data. For more details, see each ttx source file.
+        final String[] INVALID_CMAP_VS_FONTS = {
+            "unsorted_cmap14_default_uvs.ttf",
+            "unsorted_cmap14_non_default_uvs.ttf"
+        };
+        for (final String file : INVALID_CMAP_VS_FONTS) {
+            final Typeface typeface = Typeface.createFromAsset(mContext.getAssets(), file);
+            assertNotNull(typeface);
+        }
+    }
 }
diff --git a/tests/tests/security/res/raw/bug_37079296.mp4 b/tests/tests/security/res/raw/bug_37079296.mp4
new file mode 100644
index 0000000..b441fd1
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_37079296.mp4
Binary files differ
diff --git a/tests/tests/security/res/raw/bug_38342499.mid b/tests/tests/security/res/raw/bug_38342499.mid
new file mode 100644
index 0000000..4d2e282
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_38342499.mid
Binary files differ
diff --git a/tests/tests/security/res/raw/bug_62673844.mp4 b/tests/tests/security/res/raw/bug_62673844.mp4
new file mode 100644
index 0000000..8b03b94
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_62673844.mp4
Binary files differ
diff --git a/tests/tests/security/src/android/security/cts/AudioSecurityTest.java b/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
index 0d453da..5bd0627 100644
--- a/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
+++ b/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
@@ -20,6 +20,7 @@
 import android.media.AudioManager;
 import android.media.AudioTrack;
 import android.media.audiofx.AudioEffect;
+import android.media.audiofx.Equalizer;
 import android.util.Log;
 
 import java.nio.ByteBuffer;
@@ -72,10 +73,12 @@
                 testEffect.test(audioEffect);
                 Log.d(TAG, "effect " + testName + " " + descriptor.name + " success");
             } catch (Exception e) {
-                Log.e(TAG, "effect " + testName + " " + descriptor.name + " failed!");
+                Log.e(TAG, "effect " + testName + " " + descriptor.name + " exception failed!",
+                        e);
                 ++failures;
             } catch (AssertionError e) {
-                Log.e(TAG, "effect " + testName + " " + descriptor.name + " failed!");
+                Log.e(TAG, "effect " + testName + " " + descriptor.name + " assert failed!",
+                        e);
                 ++failures;
             }
         }
@@ -118,6 +121,17 @@
         });
     }
 
+    // b/37536407
+    public void testAllEffectsEqualizer_CVE_2017_0401() throws Exception {
+        testAllEffects("equalizer get parameter name",
+                new TestEffect() {
+            @Override
+            public void test(AudioEffect audioEffect) throws Exception {
+                testAudioEffectEqualizerGetParameterName(audioEffect);
+            }
+        });
+    }
+
     private static void testAudioEffectGetParameter(
             AudioEffect audioEffect, boolean offload) throws Exception {
         if (audioEffect == null) {
@@ -297,6 +311,37 @@
         }
     }
 
+    private static void testAudioEffectEqualizerGetParameterName(
+            AudioEffect audioEffect) throws Exception {
+        if (audioEffect == null) {
+            return;
+        }
+        try {
+            // get parameter name with zero vsize
+            {
+                final int param = Equalizer.PARAM_GET_PRESET_NAME;
+                final int band = 0;
+                byte command[] = ByteBuffer.allocate(5 * 4 /* capacity */)
+                        .order(ByteOrder.nativeOrder())
+                        .putInt(0)          // status (unused)
+                        .putInt(8)          // psize (param, band)
+                        .putInt(0)          // vsize
+                        .putInt(param)      // equalizer param
+                        .putInt(band)       // equalizer band
+                        .array();
+                Integer ret = (Integer) AudioEffect.class.getDeclaredMethod(
+                        "command", int.class, byte[].class, byte[].class).invoke(
+                                audioEffect, EFFECT_CMD_GET_PARAM, command,
+                                new byte[5 * 4] /* reply - ignored */);
+                assertTrue("Audio server might have crashed", ret != ERROR_DEAD_OBJECT);
+            }
+        } catch (NoSuchMethodException e) {
+            Log.w(TAG, "AudioEffect.command() does not exist (ignoring)"); // OK
+        } finally {
+            audioEffect.release();
+        }
+    }
+
     // should match effect_visualizer.h (native)
     private static final String VISUALIZER_TYPE = "e46b26a0-dddd-11db-8afd-0002a5d5c51b";
     private static final int VISUALIZER_CMD_CAPTURE = 0x10000;
diff --git a/tests/tests/security/src/android/security/cts/EffectBundleTest.java b/tests/tests/security/src/android/security/cts/EffectBundleTest.java
index c57f73f..066e305 100644
--- a/tests/tests/security/src/android/security/cts/EffectBundleTest.java
+++ b/tests/tests/security/src/android/security/cts/EffectBundleTest.java
@@ -150,6 +150,61 @@
                 eqGetParamFreqRangeCommand(MEDIA_LONG));
     }
 
+    //testing security bug: 37563371 (short media)
+    public void testEqualizer_setParamProperties_short() throws Exception {
+        assertTrue("testEqualizer_setParamProperties_long did not complete successfully",
+                eqSetParamProperties(MEDIA_SHORT));
+    }
+
+    //testing security bug: 37563371 (long media)
+    public void testEqualizer_setParamProperties_long() throws Exception {
+        assertTrue("testEqualizer_setParamProperties_long did not complete successfully",
+                eqSetParamProperties(MEDIA_LONG));
+    }
+
+    private boolean eqSetParamProperties(int media) {
+        MediaPlayer mp = null;
+        Equalizer eq = null;
+        boolean status = false;
+        try {
+            mp = MediaPlayer.create(getInstrumentation().getContext(),  getMediaId(media));
+            eq = new Equalizer(0 /*priority*/, mp.getAudioSessionId());
+
+            int intSize = 4; //bytes
+            int shortSize = 2; //bytes
+
+            int cmdCode = 5; // EFFECT_CMD_SET_PARAM
+            byte command[] = concatArrays(/*status*/ intToByteArray(0),
+                    /*psize*/ intToByteArray(1 * intSize),
+                    /*vsize*/ intToByteArray(2 * shortSize),
+                    /*data[0]*/ intToByteArray((int) 9 /*EQ_PARAM_PROPERTIES*/),
+                    /*data[4]*/ shortToByteArray((short)-1 /*preset*/),
+                    /*data[6]*/ shortToByteArray((short)5 /*FIVEBAND_NUMBANDS*/));
+            byte reply[] = new byte[ 4 /*command.length*/];
+
+            AudioEffect af = eq;
+            Object o = AudioEffect.class.getDeclaredMethod("command", int.class, byte[].class,
+                    byte[].class).invoke(af, cmdCode, command, reply);
+
+            int replyValue = byteArrayToInt(reply, 0 /*offset*/);
+            if (replyValue >= 0) {
+                Log.w(TAG, "Reply Value: " + replyValue);
+            }
+            assertTrue("Negative replyValue was expected ", replyValue < 0);
+            status = true;
+        } catch (Exception e) {
+            Log.w(TAG,"Problem setting parameter in equalizer");
+        } finally {
+            if (eq != null) {
+                eq.release();
+            }
+            if (mp != null) {
+                mp.release();
+            }
+        }
+        return status;
+    }
+
     private boolean eqGetParamFreqRangeCommand(int media) {
         MediaPlayer mp = null;
         Equalizer eq = null;
@@ -316,6 +371,12 @@
         return converter.array();
     }
 
+    public static int byteArrayToInt(byte[] valueBuf, int offset) {
+        ByteBuffer converter = ByteBuffer.wrap(valueBuf);
+        converter.order(ByteOrder.nativeOrder());
+        return converter.getInt(offset);
+    }
+
     private static byte[] shortToByteArray(short value) {
         ByteBuffer converter = ByteBuffer.allocate(2);
         converter.order(ByteOrder.nativeOrder());
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index 952a8f8..ed4f950 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -69,6 +69,18 @@
      before any existing test methods
      ***********************************************************/
 
+    public void testStagefrightANR_bug_62673844() throws Exception {
+        doStagefrightTestANR(R.raw.bug_62673844);
+    }
+
+    public void testStagefright_bug_37079296() throws Exception {
+        doStagefrightTest(R.raw.bug_37079296);
+    }
+
+    public void testStagefright_bug_38342499() throws Exception {
+        doStagefrightTest(R.raw.bug_38342499);
+    }
+
     public void testStagefright_bug_23270724() throws Exception {
         doStagefrightTest(R.raw.bug_23270724_1);
         doStagefrightTest(R.raw.bug_23270724_2);
@@ -227,6 +239,10 @@
         server.shutdown();
     }
 
+    private void doStagefrightTestANR(final int rid) throws Exception {
+        doStagefrightTestMediaPlayerANR(rid, null);
+    }
+
     private Surface getDummySurface() {
         int[] textures = new int[1];
         GLES20.glGenTextures(1, textures, 0);
@@ -280,6 +296,7 @@
         public void onCompletion(MediaPlayer mp) {
             // preserve error condition, if any
             lock.lock();
+            completed = true;
             condition.signal();
             lock.unlock();
         }
@@ -299,9 +316,19 @@
             return what;
         }
 
+        public boolean waitForErrorOrCompletion() throws InterruptedException {
+            lock.lock();
+            if (condition.awaitNanos(TIMEOUT_NS) <= 0) {
+                Log.d(TAG, "timed out on waiting for error or completion");
+            }
+            lock.unlock();
+            return (what != 0 && what != MediaPlayer.MEDIA_ERROR_SERVER_DIED) || completed;
+        }
+
         ReentrantLock lock = new ReentrantLock();
         Condition condition = lock.newCondition();
         int what;
+        boolean completed = false;
     }
 
     class LooperThread extends Thread {
@@ -630,4 +657,50 @@
         thr.stopLooper();
         thr.join();
     }
+
+    private void doStagefrightTestMediaPlayerANR(final int rid, final String uri) throws Exception {
+        String name = uri != null ? uri :
+            getInstrumentation().getContext().getResources().getResourceEntryName(rid);
+        Log.i(TAG, "start mediaplayerANR test for: " + name);
+
+        final MediaPlayerCrashListener mpl = new MediaPlayerCrashListener();
+
+        LooperThread t = new LooperThread(new Runnable() {
+            @Override
+            public void run() {
+                MediaPlayer mp = new MediaPlayer();
+                mp.setOnErrorListener(mpl);
+                mp.setOnPreparedListener(mpl);
+                mp.setOnCompletionListener(mpl);
+                Surface surface = getDummySurface();
+                mp.setSurface(surface);
+                AssetFileDescriptor fd = null;
+                try {
+                    if (uri == null) {
+                        fd = getInstrumentation().getContext().getResources()
+                                .openRawResourceFd(rid);
+
+                        mp.setDataSource(fd.getFileDescriptor(),
+                                fd.getStartOffset(),
+                                fd.getLength());
+                    } else {
+                        mp.setDataSource(uri);
+                    }
+                    mp.prepareAsync();
+                } catch (Exception e) {
+                } finally {
+                    closeQuietly(fd);
+                }
+
+                Looper.loop();
+                mp.release();
+            }
+        });
+
+        t.start();
+        String cve = name.replace("_", "-").toUpperCase();
+        assertTrue("Device *IS* vulnerable to " + cve, mpl.waitForErrorOrCompletion());
+        t.stopLooper();
+        t.join(); // wait for thread to exit so we're sure the player was released
+    }
 }
diff --git a/tools/tradefed-host/src/com/android/cts/tradefed/build/CtsBuildProvider.java b/tools/tradefed-host/src/com/android/cts/tradefed/build/CtsBuildProvider.java
index 82acc8e..1989e58 100644
--- a/tools/tradefed-host/src/com/android/cts/tradefed/build/CtsBuildProvider.java
+++ b/tools/tradefed-host/src/com/android/cts/tradefed/build/CtsBuildProvider.java
@@ -31,7 +31,7 @@
     @Option(name="cts-install-path", description="the path to the cts installation to use")
     private String mCtsRootDirPath = System.getProperty("CTS_ROOT");
 
-    public static final String CTS_BUILD_VERSION = "5.1_r23";
+    public static final String CTS_BUILD_VERSION = "5.1_r24";
 
     /**
      * {@inheritDoc}