Snap for 5715241 from f92db984416ec02a2b5cdf2c40b4cdf0ffe6203a to qt-aml-release
Change-Id: Iba792f2de0c5fc76be50199d6370838a6b7d44e4
diff --git a/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java b/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
index 3ea6b63..be91308 100644
--- a/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
+++ b/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
@@ -20,6 +20,7 @@
import android.drm.DrmConvertedStatus;
import android.drm.DrmManagerClient;
import android.graphics.ImageFormat;
+import android.graphics.Rect;
import android.media.Image;
import android.media.Image.Plane;
import android.media.MediaCodec;
@@ -1154,36 +1155,46 @@
MessageDigest md = MessageDigest.getInstance("MD5");
- int imageWidth = image.getWidth();
- int imageHeight = image.getHeight();
+ Rect crop = image.getCropRect();
+ int cropLeft = crop.left;
+ int cropRight = crop.right;
+ int cropTop = crop.top;
+ int cropBottom = crop.bottom;
+
+ int imageWidth = cropRight - cropLeft + 1;
+ int imageHeight = cropBottom - cropTop + 1;
Image.Plane[] planes = image.getPlanes();
for (int i = 0; i < planes.length; ++i) {
ByteBuffer buf = planes[i].getBuffer();
- int width, height, rowStride, pixelStride, x, y;
+ int width, height, rowStride, pixelStride, x, y, top, left;
rowStride = planes[i].getRowStride();
pixelStride = planes[i].getPixelStride();
if (i == 0) {
width = imageWidth;
height = imageHeight;
+ left = cropLeft;
+ top = cropTop;
} else {
width = imageWidth / 2;
height = imageHeight /2;
+ left = cropLeft / 2;
+ top = cropTop / 2;
}
// local contiguous pixel buffer
byte[] bb = new byte[width * height];
if (buf.hasArray()) {
byte b[] = buf.array();
- int offs = buf.arrayOffset();
+ int offs = buf.arrayOffset() + left * pixelStride;
if (pixelStride == 1) {
for (y = 0; y < height; ++y) {
- System.arraycopy(bb, y * width, b, y * rowStride + offs, width);
+ System.arraycopy(bb, y * width, b, (top + y) * rowStride + offs, width);
}
} else {
// do it pixel-by-pixel
for (y = 0; y < height; ++y) {
- int lineOffset = offs + y * rowStride;
+ int lineOffset = offs + (top + y) * rowStride;
for (x = 0; x < width; ++x) {
bb[y * width + x] = b[lineOffset + x * pixelStride];
}
@@ -1193,7 +1204,7 @@
int pos = buf.position();
if (pixelStride == 1) {
for (y = 0; y < height; ++y) {
- buf.position(pos + y * rowStride);
+ buf.position(pos + left + (top + y) * rowStride);
buf.get(bb, y * width, width);
}
} else {
@@ -1201,7 +1212,7 @@
byte[] lb = new byte[rowStride];
// do it pixel-by-pixel
for (y = 0; y < height; ++y) {
- buf.position(pos + y * rowStride);
+ buf.position(pos + left * pixelStride + (top + y) * rowStride);
// we're only guaranteed to have pixelStride * (width - 1) + 1 bytes
buf.get(lb, 0, pixelStride * (width - 1) + 1);
for (x = 0; x < width; ++x) {
diff --git a/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java b/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
old mode 100644
new mode 100755
index 09282b3..e674008
--- a/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
+++ b/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
@@ -31,6 +31,7 @@
private static final String EXTRA_MESSENGER = "messenger";
private static final int MSG_NOTIFY_NETWORK_STATE = 1;
+ private static final int WAIT_TO_ALLOW_CONNECTING_MS = 2000;
@Override
public void onCreate(Bundle icicle) {
@@ -60,6 +61,15 @@
private NetworkInfo getActiveNetworkInfo() {
final ConnectivityManager cm = (ConnectivityManager) getSystemService(
Context.CONNECTIVITY_SERVICE);
+ waitToAllowConnecting();
return cm.getActiveNetworkInfo();
}
+
+ private void waitToAllowConnecting() {
+ try {
+ Thread.sleep(WAIT_TO_ALLOW_CONNECTING_MS);
+ } catch (InterruptedException e) {
+ throw new IllegalStateException(e);
+ }
+ }
}
diff --git a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
index e69dc5f..d6bc90e 100644
--- a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
+++ b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
@@ -113,6 +113,6 @@
private static final String NO_OP_TEST =
"android.inputmethodservice.cts.devicetest.NoOpDeviceTest";
- public static final TestInfo TEST_WAIT_3SEC =
- new TestInfo(PACKAGE, NO_OP_TEST, "testWait3Sec");
+ public static final TestInfo TEST_WAIT_15SEC =
+ new TestInfo(PACKAGE, NO_OP_TEST, "testWait15Sec");
}
diff --git a/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java b/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
index 34402ee..dcd79f5 100644
--- a/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
+++ b/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
@@ -29,9 +29,9 @@
@RunWith(AndroidJUnit4.class)
public class NoOpDeviceTest {
- /** Does nothing but just wait 3 seconds. */
+ /** Does nothing but just wait 15 seconds. */
@Test
- public void testWait3Sec() {
- SystemClock.sleep(3000);
+ public void testWait15Sec() {
+ SystemClock.sleep(15000);
}
}
diff --git a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
index af7d944..4c2d884 100644
--- a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
+++ b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
@@ -351,13 +351,13 @@
try {
// This test should never fail. If this fails, it means that the system was not yet
// ready to run tests in this APK.
- runTestAsUser(DeviceTestConstants.TEST_WAIT_3SEC, userId);
+ runTestAsUser(DeviceTestConstants.TEST_WAIT_15SEC, userId);
return;
} catch (AssertionError e) {
// Ignoring because it can be because of Bug 132082599.
}
}
- runTestAsUser(DeviceTestConstants.TEST_WAIT_3SEC, userId);
+ runTestAsUser(DeviceTestConstants.TEST_WAIT_15SEC, userId);
}
diff --git a/tests/tests/media/src/android/media/cts/AudioTrackTest.java b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
old mode 100644
new mode 100755
index d52dc16..fa20770
--- a/tests/tests/media/src/android/media/cts/AudioTrackTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
@@ -1451,7 +1451,7 @@
// constant for test
final String TEST_NAME = "testGetMinBufferSizeTooHighSR";
// FIXME need an API to retrieve AudioTrack.SAMPLE_RATE_HZ_MAX
- final int TEST_SR = 192001;
+ final int TEST_SR = AudioFormat.SAMPLE_RATE_HZ_MAX + 1;
final int TEST_CONF = AudioFormat.CHANNEL_CONFIGURATION_MONO;
final int TEST_FORMAT = AudioFormat.ENCODING_PCM_8BIT;
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecTest.java b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
index 3802110..7151d36 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
@@ -2030,6 +2030,7 @@
private int mBufOut = 0;
private int mBufCounter = 0;
+ private MediaExtractor mExtractor; // Read from Extractor instead of InputStream
// helper for bytewise read()
private byte[] mOneByte = new byte[1];
@@ -2072,6 +2073,12 @@
mBufferInputStream = input;
}
+ MediaCodecStream(MediaExtractor mediaExtractor,
+ MediaFormat format) throws Exception {
+ this(format, false /* encode */);
+ mExtractor = mediaExtractor;
+ }
+
@Override
public ByteBuffer read() throws IOException {
@@ -2091,8 +2098,19 @@
buf.clear();
int inBufLen = buf.limit();
int numRead = 0;
-
- if (mBufferInputStream != null) {
+ long timestampUs = 0; // non-zero for MediaExtractor mode
+ if (mExtractor != null) {
+ numRead = mExtractor.readSampleData(buf, 0 /* offset */);
+ timestampUs = mExtractor.getSampleTime();
+ Log.v(TAG, "MediaCodecStream.read using Extractor, numRead "
+ + numRead +" timestamp " + timestampUs);
+ mExtractor.advance();
+ if(numRead < 0) {
+ mSawInputEOS = true;
+ timestampUs = 0;
+ numRead =0;
+ }
+ } else if (mBufferInputStream != null) {
ByteBuffer in = null;
do {
in = mBufferInputStream.read();
@@ -2122,7 +2140,7 @@
}
int flags = mSawInputEOS ? MediaCodec.BUFFER_FLAG_END_OF_STREAM : 0;
- if (!mEncode && !mSentConfig) {
+ if (!mEncode && !mSentConfig && mExtractor == null) {
flags |= MediaCodec.BUFFER_FLAG_CODEC_CONFIG;
mSentConfig = true;
}
@@ -2132,7 +2150,7 @@
mCodec.queueInputBuffer(index,
0 /* offset */,
numRead,
- 0 /* presentationTimeUs */,
+ timestampUs /* presentationTimeUs */,
flags);
Log.i(TAG, "queued input buffer " + index + ", size " + numRead);
}
diff --git a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
index 0a6ab99f..67de797 100644
--- a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
@@ -399,9 +399,10 @@
public MediaFormat mFormat;
private MediaExtractor mExtractor;
+ private MediaCodecTest.MediaCodecStream mDecoderStream;
public MediaExtractorStream(
- String mime,
+ String inMime, String outMime,
MediaDataSource dataSource) throws Exception {
mExtractor = new MediaExtractor();
mExtractor.setDataSource(dataSource);
@@ -411,23 +412,26 @@
for (int i = 0; i < numTracks; ++i) {
final MediaFormat format = mExtractor.getTrackFormat(i);
final String actualMime = format.getString(MediaFormat.KEY_MIME);
- if (mime.equals(actualMime)) {
- mExtractor.selectTrack(i);
- mFormat = format;
+ mExtractor.selectTrack(i);
+ mFormat = format;
+ if (outMime.equals(actualMime)) {
break;
+ } else { // no matching mime, try to use decoder
+ mDecoderStream = new MediaCodecTest.MediaCodecStream(
+ mExtractor, mFormat);
+ Log.w(TAG, "fallback to input mime type with decoder");
}
}
- assertNotNull("MediaExtractor cannot find mime type " + mime, mFormat);
+ assertNotNull("MediaExtractor cannot find mime type " + inMime, mFormat);
mIsFloat = mFormat.getInteger(
MediaFormat.KEY_PCM_ENCODING, AudioFormat.ENCODING_PCM_16BIT)
== AudioFormat.ENCODING_PCM_FLOAT;
-
}
public MediaExtractorStream(
- String mime,
+ String inMime, String outMime,
MediaCodecTest.ByteBufferStream inputStream) throws Exception {
- this(mime, new ByteBufferDataSource(inputStream));
+ this(inMime, outMime, new ByteBufferDataSource(inputStream));
}
@Override
@@ -435,7 +439,9 @@
if (mSawOutputEOS) {
return null;
}
-
+ if (mDecoderStream != null) {
+ return mDecoderStream.read();
+ }
// To preserve codec-like behavior, we create ByteBuffers
// equal to the media sample size.
final long size = mExtractor.getSampleSize();
@@ -500,7 +506,8 @@
new MediaCodecTest.ByteBufferInputStream(audioStream),
format, true /* encode */);
final MediaExtractorStream flacToRaw =
- new MediaExtractorStream("audio/raw", rawToFlac);
+ new MediaExtractorStream(MediaFormat.MIMETYPE_AUDIO_FLAC /* inMime */,
+ MediaFormat.MIMETYPE_AUDIO_RAW /* outMime */, rawToFlac);
// Note: the existence of signed zero (as well as NAN) may make byte
// comparisons invalid for floating point output. In our case, since the
diff --git a/tests/tests/security/AndroidManifest.xml b/tests/tests/security/AndroidManifest.xml
index df94dfe..4207444 100644
--- a/tests/tests/security/AndroidManifest.xml
+++ b/tests/tests/security/AndroidManifest.xml
@@ -49,6 +49,15 @@
<category android:name="android.intent.category.FRAMEWORK_INSTRUMENTATION_TEST"/>
</intent-filter>
</activity>
+
+ <activity
+ android:name="android.security.cts.SkiaJpegDecodingActivity"
+ android:label="Test overflow in libskia JPG processing">
+ <intent-filter>
+ <action android:name="android.intent.action.MAIN"/>
+ <category android:name="android.intent.category.FRAMEWORK_INSTRUMENTATION_TEST"/>
+ </intent-filter>
+ </activity>
</application>
<instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
diff --git a/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg b/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg
new file mode 100644
index 0000000..f63f6ef
--- /dev/null
+++ b/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg
Binary files differ
diff --git a/tests/tests/security/res/layout/activity_skiajpegdecoding.xml b/tests/tests/security/res/layout/activity_skiajpegdecoding.xml
new file mode 100644
index 0000000..68a0d68
--- /dev/null
+++ b/tests/tests/security/res/layout/activity_skiajpegdecoding.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+<LinearLayout
+ xmlns:android="http://schemas.android.com/apk/res/android"
+ android:layout_width="fill_parent"
+ android:layout_height="fill_parent"
+ android:gravity="center"
+ android:orientation="vertical">
+
+ <ImageView
+ android:layout_width="wrap_content"
+ android:layout_height="wrap_content"
+ android:src="@drawable/signal_sigsegv_in_jmem_ashmem"
+ />
+
+</LinearLayout>
\ No newline at end of file
diff --git a/tests/tests/security/res/raw/bug_113260892_hevc.mp4 b/tests/tests/security/res/raw/bug_113260892_hevc.mp4
new file mode 100644
index 0000000..6dfebba
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_113260892_hevc.mp4
Binary files differ
diff --git a/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java
new file mode 100644
index 0000000..8289784
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.app.Activity;
+import android.os.Bundle;
+
+import android.security.cts.R;
+
+public class SkiaJpegDecodingActivity extends Activity {
+ @Override
+ protected void onCreate(Bundle savedInstanceState) {
+ super.onCreate(savedInstanceState);
+ }
+}
diff --git a/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java
new file mode 100644
index 0000000..55525e0
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.app.Activity;
+import android.test.ActivityInstrumentationTestCase2;
+
+public class SkiaJpegDecodingTest extends
+ ActivityInstrumentationTestCase2<SkiaJpegDecodingActivity> {
+ private Activity mActivity;
+
+ public SkiaJpegDecodingTest() {
+ super(SkiaJpegDecodingActivity.class);
+ }
+
+ @Override
+ protected void setUp() throws Exception {
+ super.setUp();
+ mActivity = getActivity();
+ assertNotNull("Failed to get the activity instance", mActivity);
+ }
+
+ public void testLibskiaOverFlowJpegProcessing() {
+ // When this is run on a vulnerable build the app will have a native crash
+ // which will fail the test. When it is run on a non-vulnerable build we may
+ // get a java-level exception, indicating that the error was handled properly
+ mActivity.runOnUiThread(new Runnable() {
+ public void run() {
+ try {
+ mActivity.setContentView(R.layout.activity_skiajpegdecoding);
+ } catch (android.view.InflateException e) {
+ return;
+ }
+ }
+ });
+ }
+
+ @Override
+ protected void tearDown() throws Exception {
+ if (mActivity != null) {
+ mActivity.finish();
+ }
+ super.tearDown();
+ }
+}
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index a39941c..b806e1b 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -810,6 +810,11 @@
doStagefrightTestRawBlob(R.raw.bug_73552574_avc, "video/avc", 320, 240, frameSizes);
}
+ @SecurityTest(minPatchLevel = "2018-12")
+ public void testBug_113260892() throws Exception {
+ doStagefrightTestRawBlob(R.raw.bug_113260892_hevc, "video/hevc", 320, 240);
+ }
+
@SecurityTest(minPatchLevel = "2018-02")
public void testStagefright_bug_68342866() throws Exception {
Thread server = new Thread() {
