[RESTRICT AUTOMERGE] CTS test for Android Security b/118372692

Bug: 118372692
Bug: 126635297
Test: Ran the new testcase on android-8.0.0_r2 with/without patch

Change-Id: I5d14ada2af63a926edcde4aec678c2e2a714f92f
diff --git a/hostsidetests/securitybulletin/AndroidTest.xml b/hostsidetests/securitybulletin/AndroidTest.xml
index c1aeae7..f188f06 100644
--- a/hostsidetests/securitybulletin/AndroidTest.xml
+++ b/hostsidetests/securitybulletin/AndroidTest.xml
@@ -217,6 +217,11 @@
         <option name="push" value="CVE-2018-9539->/data/local/tmp/CVE-2018-9539" />
 
         <!--__________________-->
+        <!-- Bulletin 2019-02 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2019-1988->/data/local/tmp/CVE-2019-1988" />
+
+        <!--__________________-->
         <!-- Bulletin 2019-03 -->
         <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
         <option name="push" value="Bug-115739809->/data/local/tmp/Bug-115739809" />
diff --git a/hostsidetests/securitybulletin/res/cve_2019_1988.mp4 b/hostsidetests/securitybulletin/res/cve_2019_1988.mp4
new file mode 100644
index 0000000..cdff65b
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2019_1988.mp4
Binary files differ
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/Android.bp
new file mode 100644
index 0000000..34d78b0
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/Android.bp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+cc_test {
+    name: "CVE-2019-1988",
+    defaults: [
+        "cts_hostsidetests_securitybulletin_defaults",
+        "skia_deps",
+    ],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    include_dirs: [
+        "external/skia/include/codec",
+        "external/skia/include/core",
+        "frameworks/native/libs/nativewindow/include",
+        "frameworks/native/libs/arect/include",
+    ],
+    shared_libs: [
+        "libhwui",
+    ],
+    static_libs: [
+        "libskia",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/poc.cpp
new file mode 100644
index 0000000..5afcb71
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-1988/poc.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SkAndroidCodec.h"
+#include "SkBitmap.h"
+#include "SkCanvas.h"
+#include "SkData.h"
+#include "SkSurface.h"
+
+#include <fstream>
+#include <iostream>
+#include "../includes/memutils.h"
+
+#define SAMPLE_SIZE 6
+char enable_selective_overload = ENABLE_NONE;
+
+int decode(sk_sp<SkData> bytes, uint8_t sampleSize) {
+    auto codec = SkAndroidCodec::MakeFromData(bytes);
+    if (!codec) {
+        return EXIT_FAILURE;
+    }
+
+    auto size = codec->getSampledDimensions(sampleSize);
+    auto info = SkImageInfo::MakeN32Premul(size);
+    SkBitmap bm;
+    if (!bm.tryAllocPixels(info)) {
+        return EXIT_FAILURE;
+    }
+
+    SkAndroidCodec::AndroidOptions options;
+    options.fSampleSize = sampleSize;
+
+    codec->getAndroidPixels(bm.info(), bm.getPixels(), bm.rowBytes(), &options);
+    return EXIT_SUCCESS;
+}
+
+int main(int argc, char **argv) {
+    if (argc != 2) {
+        return EXIT_FAILURE;
+    }
+    std::ifstream inFile(argv[1]);
+    if (!inFile) {
+        return EXIT_FAILURE;
+    }
+    inFile.seekg(0, inFile.end);
+    size_t size = inFile.tellg();
+    if (size < 1) {
+        inFile.close();
+        return EXIT_FAILURE;
+    }
+    inFile.seekg(0, inFile.beg);
+    uint8_t *data = (uint8_t *)malloc(size);
+    if (!data) {
+        return EXIT_FAILURE;
+    }
+    inFile.read(reinterpret_cast<char *>(data), size);
+    auto bytes = SkData::MakeWithoutCopy(data, size);
+    bytes = SkData::MakeSubset(bytes.get(), 1, size - 1);
+    enable_selective_overload = ENABLE_ALL;
+    int ret = decode(bytes, SAMPLE_SIZE);
+    enable_selective_overload = ENABLE_NONE;
+    inFile.close();
+    free(data);
+    return ret;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
index 1ce626b..edf49c7 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
@@ -45,6 +45,18 @@
      ******************************************************************************/
 
     /**
+     * b/118372692
+     * Vulnerability Behaviour: SIGSEGV in self
+     */
+    @SecurityTest(minPatchLevel = "2019-02")
+    @Test
+    public void testPocCVE_2019_1988() throws Exception {
+        String inputFiles[] = {"cve_2019_1988.mp4"};
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-1988",
+                AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
+    }
+
+    /**
      * b/63522430
      * Vulnerability Behaviour: SIGSEGV in media.codec
      */