Merge cherrypicks of [11569582, 11569838, 11569699, 11569700, 11569701, 11569703, 11569839, 11569840, 11569841, 11569842, 11569759, 11569760, 11569843, 11569938, 11569522, 11569642, 11569643, 11569644, 11569958, 11569959, 11569584, 11569585, 11569586, 11569587, 11569645, 11569646, 11570018] into qt-d4-releaseandroid-10.0.0_r45android-10.0.0_r44android10-d4-release

Change-Id: Ia75deb0fa0c78810f813faacc6b0c209481e717c

3 files changed, 12 insertions, 0 deletions

diff --git a/tests/tests/permission2/res/raw/android_manifest.xml b/tests/tests/permission2/res/raw/android_manifest.xml
index a2e044ac89b..f93376d337e 100644
--- a/tests/tests/permission2/res/raw/android_manifest.xml
+++ b/tests/tests/permission2/res/raw/android_manifest.xml
@@ -3466,6 +3466,11 @@
     <permission android:name="android.permission.OBSERVE_ROLE_HOLDERS"
         android:protectionLevel="signature|installer" />
 
+    <!-- Allows an application to manage the companion devices.
+         @hide -->
+    <permission android:name="android.permission.MANAGE_COMPANION_DEVICES"
+                android:protectionLevel="signature" />
+
     <!-- @SystemApi Allows an application to use SurfaceFlinger's low level features.
          <p>Not for use by third-party applications.
          @hide
diff --git a/tests/tests/security/res/raw/bug_156261521.dng b/tests/tests/security/res/raw/bug_156261521.dng
new file mode 100644
index 00000000000..b83884424e6
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_156261521.dng
diff --git a/tests/tests/security/src/android/security/cts/BitmapFactorySecurityTests.java b/tests/tests/security/src/android/security/cts/BitmapFactorySecurityTests.java
index 8ffe485ec1a..f4638552e2b 100644
--- a/tests/tests/security/src/android/security/cts/BitmapFactorySecurityTests.java
+++ b/tests/tests/security/src/android/security/cts/BitmapFactorySecurityTests.java
@@ -83,4 +83,11 @@ public class BitmapFactorySecurityTests extends AndroidTestCase {
             fail("OOM attempting to decode BMP");
         }
     }
+
+    @SecurityTest
+    public void test_android_bug_156261521() {
+        // Previously decoding this would crash.
+        FileDescriptor exploitImage = getResource(R.raw.bug_156261521);
+        BitmapFactory.decodeFileDescriptor(exploitImage);
+    }
 }