Snap for 6131310 from 55bccd3445d0c869c95ae4b4c51313aa43d4f45f to qt-aml-media-releaseandroid-mainline-10.0.0_r10android10-mainline-media-release

Change-Id: Iab97794c64e3aa4cce2cbab91307a4a6ffdd311c

33 files changed, 1011 insertions, 179 deletions

diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/BroadcastTestBase.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/BroadcastTestBase.java
index 7500050718e..6359565264d 100644
--- a/common/device-side/util-axt/src/com/android/compatibility/common/util/BroadcastTestBase.java
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/BroadcastTestBase.java
@@ -18,11 +18,15 @@ package com.android.compatibility.common.util;
 
 import android.content.BroadcastReceiver;
 import android.content.ComponentName;
+import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.pm.PackageManager;
+import android.database.ContentObserver;
+import android.net.Uri;
 import android.os.Bundle;
+import android.os.Handler;
 import android.test.ActivityInstrumentationTestCase2;
 import android.util.Log;
 
@@ -122,4 +126,36 @@ public class BroadcastTestBase extends ActivityInstrumentationTestCase2<
             }
         }
     }
+
+    protected CountDownLatch registerForChanges(Uri uri) throws Exception {
+        final CountDownLatch latch = new CountDownLatch(1);
+        final ContentResolver resolver = mActivity.getContentResolver();
+        mActivity.runOnUiThread(() -> {
+            resolver.registerContentObserver(uri, true,
+                    new ContentObserver(new Handler()) {
+                        @Override
+                        public void onChange(boolean selfChange) {
+                            latch.countDown();
+                            resolver.unregisterContentObserver(this);
+                        }
+                    });
+        });
+        return latch;
+    }
+
+    protected boolean startTestAndWaitForChange(BroadcastUtils.TestcaseType testCaseType, Uri uri,
+            String pkg, String cls)
+            throws Exception {
+        Log.i(TAG, "Begin Testing: " + testCaseType);
+        registerBroadcastReceiver(testCaseType);
+        CountDownLatch latch = registerForChanges(uri);
+        mActivity.startTest(testCaseType.toString(), pkg, cls);
+        if (!mLatch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS)
+                || !latch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
+            fail("Failed to change in " + TIMEOUT_MS + "msec");
+            return false;
+        }
+        return true;
+    }
+
 }
diff --git a/hostsidetests/appsecurity/test-apps/DocumentClient/src/com/android/cts/documentclient/DocumentsClientTestCase.java b/hostsidetests/appsecurity/test-apps/DocumentClient/src/com/android/cts/documentclient/DocumentsClientTestCase.java
index 31fac487f68..09a4d810d1c 100644
--- a/hostsidetests/appsecurity/test-apps/DocumentClient/src/com/android/cts/documentclient/DocumentsClientTestCase.java
+++ b/hostsidetests/appsecurity/test-apps/DocumentClient/src/com/android/cts/documentclient/DocumentsClientTestCase.java
@@ -163,7 +163,8 @@ abstract class DocumentsClientTestCase extends InstrumentationTestCase {
 
     protected boolean supportedHardwareForScopedDirectoryAccess() {
         final PackageManager pm = getInstrumentation().getContext().getPackageManager();
-        if (pm.hasSystemFeature("android.hardware.type.watch")
+        if (pm.hasSystemFeature("android.hardware.type.television")
+                || pm.hasSystemFeature("android.hardware.type.watch")
                 || pm.hasSystemFeature("android.hardware.type.automotive")) {
             return false;
         }
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
index ceafda188ae..059635ac5c3 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
@@ -857,6 +857,11 @@ public abstract class DeviceAndProfileOwnerTest extends BaseDevicePolicyTest {
             return;
         }
 
+        if (!hasService("wallpaper")) {
+            CLog.d("testSetWallpaper_disallowed(): device does not support wallpapers");
+            return;
+        }
+
         installAppAsUser(CUSTOMIZATION_APP_APK, mUserId);
         try {
             changeUserRestrictionOrFail(DISALLOW_SET_WALLPAPER, true, mUserId);
@@ -873,6 +878,10 @@ public abstract class DeviceAndProfileOwnerTest extends BaseDevicePolicyTest {
         if (!mHasFeature) {
             return;
         }
+        if (!hasService("wallpaper")) {
+            CLog.d("testDisallowSetWallpaper_allowed(): device does not support wallpapers");
+            return;
+        }
         executeDeviceTestMethod(".CustomizationRestrictionsTest",
                 "testDisallowSetWallpaper_allowed");
     }
diff --git a/hostsidetests/dumpsys/src/android/dumpsys/cts/BatteryStatsDumpsysTest.java b/hostsidetests/dumpsys/src/android/dumpsys/cts/BatteryStatsDumpsysTest.java
index 5aaef1935b5..5aaef1935b5 100644..100755
--- a/hostsidetests/dumpsys/src/android/dumpsys/cts/BatteryStatsDumpsysTest.java
+++ b/hostsidetests/dumpsys/src/android/dumpsys/cts/BatteryStatsDumpsysTest.java
diff --git a/hostsidetests/securitybulletin/AndroidTest.xml b/hostsidetests/securitybulletin/AndroidTest.xml
index 1c27c08e401..cdb350cd9a6 100644
--- a/hostsidetests/securitybulletin/AndroidTest.xml
+++ b/hostsidetests/securitybulletin/AndroidTest.xml
@@ -64,10 +64,12 @@
         <!--__________________-->
         <!-- Bulletin 2016-06 -->
         <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-2482->/data/local/tmp/CVE-2016-2482" />
 
         <!--__________________-->
         <!-- Bulletin 2016-07 -->
         <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-3747->/data/local/tmp/CVE-2016-3747" />
         <option name="push" value="CVE-2014-9803->/data/local/tmp/CVE-2014-9803" />
         <option name="push" value="CVE-2016-3746->/data/local/tmp/CVE-2016-3746" />
         <option name="push" value="CVE-2016-3818->/data/local/tmp/CVE-2016-3818" />
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/Android.mk
new file mode 100644
index 00000000000..bb7ecac6a4e
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/Android.mk
@@ -0,0 +1,41 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := CVE-2016-2482
+LOCAL_SRC_FILES := poc.cpp
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+LOCAL_C_INCLUDES := $(JNI_H_INCLUDE) \
+                    $(TOP)/frameworks/native/include/media/openmax \
+
+LOCAL_SHARED_LIBRARIES := libnativehelper \
+                          liblog \
+                          libstagefright \
+                          libbinder \
+                          libutils \
+                          libmedia \
+                          libmedia_omx \
+                          libstagefright_foundation
+
+LOCAL_COMPATIBILITY_SUITE := cts sts vts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+LOCAL_ARM_MODE := arm
+LOCAL_CPPFLAGS += -Wall -Werror
+
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/poc.cpp
new file mode 100644
index 00000000000..7215e008792
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2016-2482/poc.cpp
@@ -0,0 +1,151 @@
+/**
+* Copyright (C) 2018 The Android Open Source Project
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*      http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
+#define LOG_TAG "CVE-2016-2482"
+
+#include <OMX_Component.h>
+#include <OMX_Types.h>
+#include <binder/IServiceManager.h>
+#include <binder/MemoryDealer.h>
+#include <media/IMediaPlayerClient.h>
+#include <media/IMediaPlayerService.h>
+#include <media/IMediaRecorder.h>
+#include <media/IOMX.h>
+#include <media/OMXBuffer.h>
+#include <media/stagefright/OMXClient.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <utils/StrongPointer.h>
+
+#define OMX_DirInput 0
+#define OMX_CORE_INPUT_PORT_INDEX 0
+
+using namespace android;
+
+struct DummyOMXObserver : public BnOMXObserver {
+public:
+  DummyOMXObserver() {}
+
+  virtual void onMessages(const std::list<omx_message> &messages __unused) {}
+
+protected:
+  virtual ~DummyOMXObserver() {}
+};
+
+// decoder
+bool fuzzIOMXSetParameterChangeCount() {
+  const char *name = "OMX.qcom.video.decoder.avc";
+  sp<IMemory> memory;
+  sp<IOMXNode> node = 0;
+  sp<IOMX> mOmx;
+  IOMX::buffer_id bufferId = 0;
+  int outMemSize = 1024;
+  int bufferCnt = 4;
+  int memSize = 49 * outMemSize * bufferCnt;
+
+  OMXClient client;
+  if (client.connect() != OK) {
+    ALOGE("OMXClient connect == NULL");
+    return false;
+  }
+
+  mOmx = client.interface();
+  if (mOmx == NULL) {
+    ALOGE("OMXClient interface mOmx == NULL");
+    client.disconnect();
+    return false;
+  }
+
+  sp<DummyOMXObserver> observerDec = new DummyOMXObserver();
+
+  ALOGE("-----------decode------------");
+  status_t err = mOmx->allocateNode(name, observerDec, &node);
+  if (err != OK) {
+    ALOGE("%s node allocation fails", name);
+    client.disconnect();
+    return false;
+  }
+
+  sp<MemoryDealer> dealerIn = new MemoryDealer(memSize);
+
+  memory = dealerIn->allocate(memSize);
+  if (memory.get() == nullptr) {
+    ALOGE("memory allocation failed , err: %d", err);
+    node->freeNode();
+    client.disconnect();
+    return false;
+  }
+
+  OMX_PARAM_PORTDEFINITIONTYPE *params = (OMX_PARAM_PORTDEFINITIONTYPE *)malloc(
+      sizeof(OMX_PARAM_PORTDEFINITIONTYPE));
+
+  if (params == NULL) {
+    ALOGE("memory allocation failed , err: %d", err);
+    node->freeNode();
+    client.disconnect();
+    return false;
+  }
+  memset(params, 0, sizeof(OMX_PARAM_PORTDEFINITIONTYPE));
+
+  params->eDir = (OMX_DIRTYPE)OMX_DirInput;
+
+  params->nBufferCountActual = 1024 * 1024 / 16;
+  params->nBufferSize = 0x31000;
+  params->format.video.nFrameHeight = 0;
+
+  /*
+   * Exit from here if setParameter fails.
+   * This is the expected behavior in Android N
+   */
+  err = node->setParameter(OMX_IndexParamPortDefinition, params,
+                           sizeof(OMX_PARAM_PORTDEFINITIONTYPE));
+  ALOGI("setParameter, err: %d", err);
+  if (err != OK) {
+    node->freeNode();
+    free(params);
+    client.disconnect();
+    return false;
+  }
+
+  /*
+   * Exit from here if useBuffer fails.
+   * This is the expected behavior in Android N
+   */
+  err = node->useBuffer(OMX_CORE_INPUT_PORT_INDEX, memory, &bufferId);
+  ALOGE("useBuffer, err: %d", err);
+  if (err != OK) {
+    node->freeNode();
+    free(params);
+    client.disconnect();
+    return false;
+  }
+
+  params->nBufferCountActual = 0xFFFFFFFF;
+
+  err = node->setParameter(OMX_IndexParamPortDefinition, params,
+                           sizeof(OMX_PARAM_PORTDEFINITIONTYPE));
+  ALOGE("setParameter, change actualcount, err: %d", err);
+
+  err = node->freeNode();
+  free(params);
+  client.disconnect();
+  ALOGI("freeNode, err: %d", err);
+  return true;
+}
+
+int main() {
+  return (int)(!fuzzIOMXSetParameterChangeCount());
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/Android.mk
new file mode 100644
index 00000000000..08041fe8a0f
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/Android.mk
@@ -0,0 +1,40 @@
+# Copyright (C) 2018 The Android Open Source Project
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := CVE-2016-3747
+LOCAL_SRC_FILES := poc.cpp
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+LOCAL_C_INCLUDES := $(JNI_H_INCLUDE) \
+                    $(TOP)/frameworks/av/media/libstagefright \
+                    $(TOP)/frameworks/native/include/media/openmax
+
+LOCAL_SHARED_LIBRARIES := \
+        libstagefright \
+        libbinder \
+        libmedia \
+        libmedia_omx \
+        liblog \
+        libutils
+
+LOCAL_COMPATIBILITY_SUITE := cts vts sts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+LOCAL_CFLAGS += -Wall -Werror
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/poc.cpp
new file mode 100644
index 00000000000..38a0afa3874
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2016-3747/poc.cpp
@@ -0,0 +1,145 @@
+/**
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CVE-2016-3747"
+
+#include <OMX_Component.h>
+#include <binder/MemoryDealer.h>
+#include <jni.h>
+#include <log/log.h>
+#include <media/IOMX.h>
+#include <media/OMXBuffer.h>
+#include <media/stagefright/OMXClient.h>
+#include <utils/StrongPointer.h>
+
+using namespace android;
+
+struct DummyOMXObserver : public BnOMXObserver {
+ public:
+  DummyOMXObserver() {}
+
+  virtual void onMessages(const std::list<omx_message> &messages __unused) {}
+
+ protected:
+  virtual ~DummyOMXObserver() {}
+};
+
+bool fuzzIOMXQcomEnc() {
+  sp<IOMXNode> node;
+  sp<IOMX> mOmx;
+  int fenceFd = -1;
+  const char *name = "OMX.qcom.video.encoder.mpeg4";
+
+  OMX_PARAM_PORTDEFINITIONTYPE *params = (OMX_PARAM_PORTDEFINITIONTYPE *)malloc(
+      sizeof(OMX_PARAM_PORTDEFINITIONTYPE));
+  params->nPortIndex = 0;  // input port
+  params->format.video.nFrameHeight = 1280 * 4;
+  params->format.video.nFrameWidth = 720 * 4;
+  params->nBufferCountActual = 12;
+  params->nBufferSize = 73728;
+  params->nBufferCountMin = 0x4;
+
+  int inMemSize = params->nBufferSize * 12;
+  int outMemSize = 49152 * 4;
+  int inBufferCnt = 12;
+  int outBufferCnt = 4;
+  int inBufferSize = inMemSize / inBufferCnt;
+  int outBufferSize = outMemSize / outBufferCnt;
+
+  sp<IMemory> memory;
+
+  OMXClient client;
+  if (client.connect() != OK) {
+    ALOGE("OMXClient connect == NULL");
+    return false;
+  }
+
+  mOmx = client.interface();
+  if (mOmx == NULL) {
+    ALOGE("OMXClient interface mOmx == NULL");
+    client.disconnect();
+    return false;
+  }
+
+  sp<DummyOMXObserver> observer = new DummyOMXObserver();
+  status_t err = mOmx->allocateNode(name, observer, &node);
+  if (err != OK) {
+    ALOGI("%s node allocation fails", name);
+    return false;
+  }
+  // make venc in invalid state
+  err = node->sendCommand(OMX_CommandStateSet, 2);
+  if (err != OK) {
+    ALOGE("sendCommand is failed in OMX_StateIdle, err: %d", err);
+    node->freeNode();
+    return false;
+  }
+
+  sp<MemoryDealer> dealerIn = new MemoryDealer(inMemSize);
+  IOMX::buffer_id *inBufferId = new IOMX::buffer_id[inBufferCnt];
+  for (int i = 0; i < inBufferCnt; i++) {
+    sp<IMemory> memory = dealerIn->allocate(inBufferSize);
+    if (memory.get() == nullptr) {
+      ALOGE("memory allocate failed for port index 0, err: %d", err);
+      node->freeNode();
+      return false;
+    }
+    OMXBuffer omxInBuf(memory);
+    err = node->useBuffer(0, omxInBuf, &inBufferId[i]);
+    ALOGI("useBuffer, port index 0, err: %d", err);
+  }
+
+  sp<MemoryDealer> dealerOut = new MemoryDealer(outMemSize);
+  IOMX::buffer_id *outBufferId = new IOMX::buffer_id[outBufferCnt];
+  for (int i = 0; i < outBufferCnt; i++) {
+    sp<IMemory> memory = dealerOut->allocate(outBufferSize);
+    if (memory.get() == nullptr) {
+      ALOGE("memory allocate failed for port index 1, err: %d", err);
+      node->freeNode();
+      return false;
+    }
+    OMXBuffer omxOutBuf(memory);
+    err = node->useBuffer(1, omxOutBuf, &outBufferId[i]);
+    ALOGI("useBuffer, port index 1, err: %d", err);
+  }
+
+  // make venc in invalid state
+  err = node->sendCommand(OMX_CommandStateSet, 3);
+  ALOGI("sendCommand, err: %d", err);
+  if (err != OK) {
+    ALOGE("sendCommand is failed in OMX_StateExecuting, err: %d", err);
+    node->freeNode();
+    return false;
+  }
+
+  OMXBuffer omxInBuf(memory);
+  for (int i = 0; i < inBufferCnt; i++) {
+    err = node->emptyBuffer(inBufferId[i], omxInBuf, 0, 0, fenceFd);
+    ALOGI("emptyBuffer, err: %d", err);
+  }
+
+  OMXBuffer omxOutBuf(memory);
+  for (int i = 0; i < outBufferCnt; i++) {
+    err = node->fillBuffer(outBufferId[i], omxOutBuf, fenceFd);
+    ALOGI("fillBuffer, err: %d", err);
+  }
+  free(params);
+  err = node->freeNode();
+  ALOGI("freeNode, err: %d", err);
+  return true;
+}
+
+int main() { return fuzzIOMXQcomEnc(); }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java b/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
index 93b5cd96d87..3e4f5b37bf8 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
@@ -408,27 +408,12 @@ public class AdbUtils {
                     AdbUtils.runCommandLine("rm /data/local/tmp/" + tempFile, device);
                 }
             }
-            if (test_failed == true) {
-                Assert.fail("PoC was interrupted");
+            if (test_failed) {
+                fail("PoC was interrupted");
             }
         }
         if (t.isAlive()) {
             Assert.fail("PoC not completed within timeout of " + timeout + " ms");
         }
     }
-
-    /**
-     * Raises assert exception upon crash/error occurence
-     *
-     * @param crashPatternList array of crash log patterns to be checked for
-     * @param logcat String to be parsed
-     */
-    public static void checkCrash(String crashPatternList[], String logcat)
-            throws Exception {
-        for (String crashPattern : crashPatternList) {
-            assertFalse("Crash log pattern found!",
-                    Pattern.compile(crashPattern, Pattern.MULTILINE)
-                            .matcher(logcat).find());
-        }
-    }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/Poc16_06.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_06.java
new file mode 100644
index 00000000000..b414a55e4df
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_06.java
@@ -0,0 +1,29 @@
+/**
+* Copyright (C) 2018 The Android Open Source Project
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*      http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
+package android.security.cts;
+
+import android.platform.test.annotations.SecurityTest;
+
+public class Poc16_06 extends SecurityTestCase {
+    /**
+     *  b/27661749
+     */
+    @SecurityTest(minPatchLevel = "2016-06")
+    public void testPocCVE_2016_2482() throws Exception {
+        AdbUtils.runPocAssertNoCrashes("CVE-2016-2482", getDevice(), "mediaserver");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/Poc16_07.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_07.java
index a0aecc5eb7f..b6346458878 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/Poc16_07.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_07.java
@@ -42,4 +42,13 @@ public class Poc16_07 extends SecurityTestCase {
     public void testPocCVE_2014_9803() throws Exception {
         AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2014-9803", getDevice(), 60);
     }
+
+    /**
+     * b/27903498
+     */
+    @SecurityTest(minPatchLevel = "2016-07")
+    public void testPocCVE_2016_3747() throws Exception {
+        getOomCatcher().setHighMemoryTest();
+        AdbUtils.runPocAssertNoCrashes("CVE-2016-3747", getDevice(), "mediaserver");
+    }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
index bbfd78e88c4..ecc086ce0d0 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
@@ -45,41 +45,6 @@ public class TestMedia extends SecurityTestCase {
      * before any existing test methods
      ****************************************************************/
 
-
-    /**
-     * Checks for linker errors
-     *
-     * @param binaryName name of the binary
-     * @param logcat String to be parsed
-     */
-    public static boolean isLinkerErrorPresent(String binaryName, String logcat)
-            throws Exception {
-        return Pattern
-                .compile("CANNOT LINK EXECUTABLE \"" + TMP_FILE_PATH
-                        + binaryName + "\"", Pattern.MULTILINE)
-                .matcher(logcat).find();
-    }
-
-    /**
-     * Checks for crash
-     *
-     * @param binaryName Name of the binary
-     * @param errPattern error patterns to be checked for
-     * @param logcat String to be parsed
-     */
-    public static void checkCrash(String binaryName, String errPattern[],
-            String logcat) throws Exception {
-        String genericCrashPattern[] = {
-                "name: " + binaryName + "  >>> " + TMP_FILE_PATH + binaryName
-                        + " <<<\n.*?SIGABRT",
-                "name: " + binaryName + "  >>> " + TMP_FILE_PATH + binaryName
-                        + " <<<\n.*?SIGSEGV"};
-        AdbUtils.checkCrash(genericCrashPattern, logcat);
-        if (errPattern != null) {
-            AdbUtils.checkCrash(errPattern, logcat);
-        }
-    }
-
     /**
      * Pushes input files, runs the PoC and checks for crash and hang
      *
@@ -91,7 +56,7 @@ public class TestMedia extends SecurityTestCase {
      */
     public static void runMediaTest(String binaryName,
             String inputFiles[], String arguments, ITestDevice device,
-            String errPattern[]) throws Exception {
+            String processPatternStrings[]) throws Exception {
         if (inputFiles != null) {
             for (String tempFile : inputFiles) {
                 AdbUtils.pushResource(RESOURCE_ROOT + tempFile,
@@ -110,10 +75,10 @@ public class TestMedia extends SecurityTestCase {
                 }
             }
         }, TIMEOUT_SEC * 1000, device, inputFiles);
-        String logcatOut = AdbUtils.runCommandLine("logcat -d", device);
-        boolean linkerErrorFound = isLinkerErrorPresent(binaryName, logcatOut);
-        if (!linkerErrorFound) {
-            checkCrash(binaryName, errPattern, logcatOut);
+
+        AdbUtils.assertNoCrashes(device, binaryName);
+        if (processPatternStrings != null) {
+            AdbUtils.assertNoCrashes(device, processPatternStrings);
         }
     }
 }
diff --git a/tests/app/src/android/app/cts/WallpaperManagerTest.java b/tests/app/src/android/app/cts/WallpaperManagerTest.java
index fe5f183acd9..3b9934a8492 100644
--- a/tests/app/src/android/app/cts/WallpaperManagerTest.java
+++ b/tests/app/src/android/app/cts/WallpaperManagerTest.java
@@ -16,6 +16,7 @@
 
 package android.app.cts;
 
+import static org.junit.Assume.assumeTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.nullable;
@@ -72,6 +73,7 @@ public class WallpaperManagerTest {
         MockitoAnnotations.initMocks(this);
         mContext = InstrumentationRegistry.getTargetContext();
         mWallpaperManager = WallpaperManager.getInstance(mContext);
+        assumeTrue("Device does not support wallpapers", mWallpaperManager.isWallpaperSupported());
         final HandlerThread handlerThread = new HandlerThread("TestCallbacks");
         handlerThread.start();
         mHandler = new Handler(handlerThread.getLooper());
@@ -477,4 +479,4 @@ public class WallpaperManagerTest {
         public void onColorsChanged(WallpaperColors colors, int which) {
         }
     }
-}
\ No newline at end of file
+}
diff --git a/tests/autofillservice/src/android/autofillservice/cts/augmented/AugmentedLoginActivityTest.java b/tests/autofillservice/src/android/autofillservice/cts/augmented/AugmentedLoginActivityTest.java
index beb598e795e..a29f918a9fc 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/augmented/AugmentedLoginActivityTest.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/augmented/AugmentedLoginActivityTest.java
@@ -527,10 +527,10 @@ public class AugmentedLoginActivityTest
                 .build());
         mActivity.onPassword(View::requestFocus);
         mUiBot.assertNoDatasetsEver();
-        final AugmentedFillRequest request2 = sAugmentedReplier.getNextFillRequest();
-        assertBasicRequestInfo(request2, mActivity, passwordId, passwordValue);
 
-        mAugmentedUiBot.assertUiShown(passwordId, "req2");
+        // (TODO: b/141703197) password request temp disabled.
+        mAugmentedUiBot.assertUiGone();
+        sAugmentedReplier.reset();
 
         // Tap on username again...
         sAugmentedReplier.addResponse(new CannedAugmentedFillResponse.Builder()
@@ -643,11 +643,11 @@ public class AugmentedLoginActivityTest
                 .build());
         mActivity.onPassword(View::requestFocus);
         mUiBot.assertNoDatasetsEver();
-        final AugmentedFillRequest request2 = sAugmentedReplier.getNextFillRequest();
-        assertBasicRequestInfo(request2, mActivity, passwordId, passwordValue);
 
-        callback.assertUiShownEvent(password);
-        mAugmentedUiBot.assertUiShown(passwordId, "req2");
+        // (TODO: b/141703197) password request temp disabled.
+        callback.assertNotCalled();
+        mAugmentedUiBot.assertUiGone();
+        sAugmentedReplier.reset();
 
         // Tap on username again...
         sAugmentedReplier.addResponse(new CannedAugmentedFillResponse.Builder()
@@ -661,13 +661,14 @@ public class AugmentedLoginActivityTest
         final AugmentedFillRequest request3 = sAugmentedReplier.getNextFillRequest();
         assertBasicRequestInfo(request3, mActivity, usernameId, usernameValue);
         final UiObject2 ui = mAugmentedUiBot.assertUiShown(usernameId, "Augment Me");
+        callback.assertUiShownEvent(username);
 
         // ...and autofill this time
         mActivity.expectAutoFill("dude", "sweet");
         ui.click();
         mActivity.assertAutoFilled();
         mAugmentedUiBot.assertUiGone();
-        callback.assertUiHiddenEvent(password);
+        callback.assertUiHiddenEvent(username);
     }
 
     @Test
diff --git a/tests/tests/car/src/android/car/cts/PermissionTest.java b/tests/tests/car/src/android/car/cts/PermissionTest.java
new file mode 100644
index 00000000000..1ab0a8a512b
--- /dev/null
+++ b/tests/tests/car/src/android/car/cts/PermissionTest.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.car.cts;
+
+import static android.car.Car.PERMISSION_CAR_TEST_SERVICE;
+
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeTrue;
+
+import android.content.pm.PackageInfo;
+import android.content.pm.PackageManager;
+import android.os.Build;
+import android.platform.test.annotations.RequiresDevice;
+import android.test.suitebuilder.annotation.SmallTest;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.compatibility.common.util.FeatureUtil;
+
+import java.util.List;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RequiresDevice
+@RunWith(AndroidJUnit4.class)
+public class PermissionTest {
+    @Before
+    public void setUp() {
+        assumeTrue(FeatureUtil.isAutomotive());
+    }
+
+    @Test
+    public void testNoCarTestServicePermission() {
+        // This test is valid only in user build.
+        assumeTrue(Build.TYPE.equals("user"));
+
+        PackageManager pm = InstrumentationRegistry.getContext().getPackageManager();
+        List<PackageInfo> holders = pm.getPackagesHoldingPermissions(new String[] {
+                PERMISSION_CAR_TEST_SERVICE
+        }, PackageManager.MATCH_UNINSTALLED_PACKAGES);
+
+        assertTrue("No pre-installed packages can have PERMISSION_CAR_TEST_SERVICE: " + holders,
+                holders.size() == 0);
+    }
+}
diff --git a/tests/tests/nativehardware/jni/AHardwareBufferGLTest.cpp b/tests/tests/nativehardware/jni/AHardwareBufferGLTest.cpp
index 7c48cd3071f..bf1b582fb9b 100644
--- a/tests/tests/nativehardware/jni/AHardwareBufferGLTest.cpp
+++ b/tests/tests/nativehardware/jni/AHardwareBufferGLTest.cpp
@@ -1592,6 +1592,14 @@ void AHardwareBufferGLTest::SetUpFramebuffer(int width, int height, int layer,
         GL_RGBA8, GL_DEPTH_COMPONENT16, GL_STENCIL_INDEX8, GL_DEPTH24_STENCIL8
     };
     GLuint& fbo = mFramebuffers[mWhich];
+    GLbitfield clear_bits[] = {
+        GL_COLOR_BUFFER_BIT, GL_DEPTH_BUFFER_BIT, GL_STENCIL_BUFFER_BIT,
+        GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT
+    };
+
+    glClearColor(0.f, 0.f, 0.f, 0.f);
+    glClearDepthf(1.0f);
+    glClearStencil(0);
     glGenFramebuffers(1, &fbo);
     glBindFramebuffer(GL_FRAMEBUFFER, fbo);
     for (int i = 0; i < 4; ++i) {
@@ -1618,7 +1626,8 @@ void AHardwareBufferGLTest::SetUpFramebuffer(int width, int height, int layer,
                 glGenRenderbuffers(1, &renderbuffer);
                 glBindRenderbuffer(GL_RENDERBUFFER, renderbuffer);
                 ASSERT_EQ(GLenum{GL_NO_ERROR}, glGetError());
-                if (GetParam().stride & kGlFormat) {
+                bool isGlFormat = GetParam().stride & kGlFormat;
+                if (isGlFormat) {
                     glRenderbufferStorage(GL_RENDERBUFFER, GetParam().format, width, height);
                 } else {
                     glEGLImageTargetRenderbufferStorageOES(GL_RENDERBUFFER,
@@ -1626,6 +1635,8 @@ void AHardwareBufferGLTest::SetUpFramebuffer(int width, int height, int layer,
                 }
                 glFramebufferRenderbuffer(GL_FRAMEBUFFER, attachment_points[i],
                                           GL_RENDERBUFFER, renderbuffer);
+                if (isGlFormat)
+                    glClear(clear_bits[i]);
                 break;
             }
             case kRenderbuffer: {
@@ -1636,8 +1647,7 @@ void AHardwareBufferGLTest::SetUpFramebuffer(int width, int height, int layer,
                 glRenderbufferStorage(GL_RENDERBUFFER, default_formats[i], width, height);
                 glFramebufferRenderbuffer(GL_FRAMEBUFFER, attachment_points[i],
                                           GL_RENDERBUFFER, renderbuffer);
-                glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
-                glClear(GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+                glClear(clear_bits[i]);
                 break;
             }
             default: FAIL() << "Unrecognized binding type";
diff --git a/tests/tests/opengl/src/android/opengl/cts/EglConfigCtsActivity.java b/tests/tests/opengl/src/android/opengl/cts/EglConfigCtsActivity.java
index cef9e2f0b6b..1b8cf77c1d1 100644
--- a/tests/tests/opengl/src/android/opengl/cts/EglConfigCtsActivity.java
+++ b/tests/tests/opengl/src/android/opengl/cts/EglConfigCtsActivity.java
@@ -16,83 +16,176 @@
 
 package android.opengl.cts;
 
+import static org.junit.Assert.assertTrue;
+
 import android.app.Activity;
-import android.content.Intent;
+import android.content.Context;
 import android.opengl.GLSurfaceView;
 import android.os.Bundle;
+import android.util.Log;
 import android.view.WindowManager;
 
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.Executor;
+import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
 
+import javax.microedition.khronos.egl.EGL10;
+import javax.microedition.khronos.egl.EGLConfig;
+import javax.microedition.khronos.egl.EGLContext;
+import javax.microedition.khronos.egl.EGLDisplay;
+
 /**
  * {@link Activity} with a {@link GLSurfaceView} that chooses a specific configuration.
  */
 public class EglConfigCtsActivity extends Activity {
 
+    private final String TAG = this.getClass().getSimpleName();
+
     public static final String CONFIG_ID_EXTRA = "eglConfigId";
 
     public static final String CONTEXT_CLIENT_VERSION_EXTRA = "eglContextClientVersion";
 
+    private static final int EGL_OPENGL_ES_BIT = 0x1;
+    private static final int EGL_OPENGL_ES2_BIT = 0x4;
+
     private EglConfigGLSurfaceView mView;
 
     private CountDownLatch mFinishedDrawing;
+    private CountDownLatch mFinishedTesting;
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        int configId = getConfigId();
-        int contextClientVersion = getContextClientVersion();
-        setTitle("EGL Config Id: " + configId + " Client Version: " + contextClientVersion);
 
         // Dismiss keyguard and keep screen on while this test is on.
         getWindow().addFlags(WindowManager.LayoutParams.FLAG_DISMISS_KEYGUARD |
                 WindowManager.LayoutParams.FLAG_TURN_SCREEN_ON |
                 WindowManager.LayoutParams.FLAG_KEEP_SCREEN_ON);
 
-        mFinishedDrawing = new CountDownLatch(1);
-        mView = new EglConfigGLSurfaceView(this, configId, contextClientVersion, new Runnable() {
-            @Override
-            public void run() {
-                mFinishedDrawing.countDown();
-            }
-        });
-        setContentView(mView);
-    }
-
-    private int getConfigId() {
-        Intent intent = getIntent();
-        if (intent != null) {
-            return intent.getIntExtra(CONFIG_ID_EXTRA, 0);
-        } else {
-            return 0;
-        }
-    }
-
-    private int getContextClientVersion() {
-        Intent intent = getIntent();
-        if (intent != null) {
-            return intent.getIntExtra(CONTEXT_CLIENT_VERSION_EXTRA, 0);
-        } else {
-            return 0;
+        int[] configIds = getEglConfigIds(EGL_OPENGL_ES_BIT);
+        int[] configIds2 = getEglConfigIds(EGL_OPENGL_ES2_BIT);
+        assertTrue(configIds.length + configIds2.length > 0);
+        mFinishedTesting = new CountDownLatch(configIds.length + configIds2.length);
+        try {
+            runConfigTests(configIds, 1);
+            runConfigTests(configIds2, 2);
+        } catch (InterruptedException e) {
+            Log.e(TAG, "Caught exception");
         }
     }
 
     @Override
     protected void onResume() {
         super.onResume();
-        mView.onResume();
+        if (mView != null)
+        {
+            mView.onResume();
+        }
     }
 
     @Override
     protected void onPause() {
         super.onPause();
-        mView.onPause();
+        if (mView != null)
+        {
+            mView.onPause();
+        }
+    }
+
+    private void runConfigTests(int[] configIds, int contextClientVersion)
+            throws InterruptedException {
+        Context context = this;
+        Thread thread = new Thread() {
+            @Override
+            public void run() {
+                for (int configId : configIds) {
+                    mFinishedDrawing = new CountDownLatch(1);
+
+                    runOnUiThread(new Runnable() {
+                        @Override
+                        public void run() {
+                            setTitle("EGL Config Id: " + configId + " Client Version: " + contextClientVersion);
+                            mView = new EglConfigGLSurfaceView(context, configId, contextClientVersion, new Runnable() {
+                                @Override
+                                public void run() {
+                                    mFinishedDrawing.countDown();
+                                }
+                            });
+                            setContentView(mView);
+                        }
+                    });
+
+                    try {
+                        waitToFinishDrawing();
+                    } catch (Exception e) {
+                        Log.e(TAG, "Timed out!");
+                    }
+
+                    mFinishedTesting.countDown();
+                }
+            }
+        };
+        thread.start();
+    }
+
+    private void waitToFinishDrawing() throws InterruptedException {
+        if (!mFinishedDrawing.await(5, TimeUnit.SECONDS)) {
+            throw new IllegalStateException("Couldn't finish drawing frames!");
+        }
     }
 
-    public void waitToFinishDrawing() throws InterruptedException {
-        if (!mFinishedDrawing.await(3, TimeUnit.SECONDS)) {
-            throw new IllegalStateException("Coudn't finish drawing frames!");
+    void waitToFinishTesting() throws InterruptedException {
+        if (!mFinishedTesting.await(300, TimeUnit.SECONDS)) {
+            throw new IllegalStateException("Couldn't finish testing!");
+        }
+    }
+
+    private static int[] getEglConfigIds(int renderableType) {
+        EGL10 egl = (EGL10) EGLContext.getEGL();
+        EGLDisplay display = egl.eglGetDisplay(EGL10.EGL_DEFAULT_DISPLAY);
+        int[] numConfigs = new int[1];
+
+        int[] attributeList = new int[] {
+                EGL10.EGL_RENDERABLE_TYPE, renderableType,
+
+                // Avoid configs like RGBA0008 which crash even though they have the window bit set.
+                EGL10.EGL_RED_SIZE, 1,
+                EGL10.EGL_GREEN_SIZE, 1,
+                EGL10.EGL_BLUE_SIZE, 1,
+
+                EGL10.EGL_SURFACE_TYPE, EGL10.EGL_WINDOW_BIT,
+                EGL10.EGL_NONE
+        };
+
+        if (egl.eglInitialize(display, null)) {
+            try {
+                if (egl.eglChooseConfig(display, attributeList, null, 0, numConfigs)) {
+                    EGLConfig[] configs = new EGLConfig[numConfigs[0]];
+                    if (egl.eglChooseConfig(display, attributeList, configs, configs.length,
+                            numConfigs)) {
+                        int[] configIds = new int[numConfigs[0]];
+                        for (int i = 0; i < numConfigs[0]; i++) {
+                            int[] value = new int[1];
+                            if (egl.eglGetConfigAttrib(display, configs[i], EGL10.EGL_CONFIG_ID,
+                                    value)) {
+                                configIds[i] = value[0];
+                            } else {
+                                throw new IllegalStateException("Couldn't call eglGetConfigAttrib");
+                            }
+                        }
+                        return configIds;
+                    } else {
+                        throw new IllegalStateException("Couldn't call eglChooseConfig (1)");
+                    }
+                } else {
+                    throw new IllegalStateException("Couldn't call eglChooseConfig (2)");
+                }
+            } finally {
+                egl.eglTerminate(display);
+            }
+        } else {
+            throw new IllegalStateException("Couldn't initialize EGL.");
         }
     }
 }
diff --git a/tests/tests/opengl/src/android/opengl/cts/EglConfigTest.java b/tests/tests/opengl/src/android/opengl/cts/EglConfigTest.java
index 3e5565eb63b..613456adc1a 100644
--- a/tests/tests/opengl/src/android/opengl/cts/EglConfigTest.java
+++ b/tests/tests/opengl/src/android/opengl/cts/EglConfigTest.java
@@ -25,6 +25,7 @@ import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.LargeTest;
 import androidx.test.rule.ActivityTestRule;
 import androidx.test.runner.AndroidJUnit4;
+import static androidx.test.internal.util.Checks.checkState;
 
 import org.junit.Before;
 import org.junit.Rule;
@@ -36,14 +37,16 @@ import javax.microedition.khronos.egl.EGLConfig;
 import javax.microedition.khronos.egl.EGLContext;
 import javax.microedition.khronos.egl.EGLDisplay;
 
+import android.util.Log;
+import java.lang.Runnable;
+
 /**
  * Test that gets a list of EGL configurations and tries to use each one in a GLSurfaceView.
  */
 @LargeTest
 @RunWith(AndroidJUnit4.class)
 public class EglConfigTest {
-    private static final int EGL_OPENGL_ES_BIT = 0x1;
-    private static final int EGL_OPENGL_ES2_BIT = 0x4;
+    private final String TAG = this.getClass().getSimpleName();
 
     private Instrumentation mInstrumentation;
 
@@ -58,75 +61,11 @@ public class EglConfigTest {
 
     @Test
     public void testEglConfigs() throws Exception {
-        int[] configIds = getEglConfigIds(EGL_OPENGL_ES_BIT);
-        int[] configIds2 = getEglConfigIds(EGL_OPENGL_ES2_BIT);
-        assertTrue(configIds.length + configIds2.length > 0);
-        runConfigTests(configIds, 1);
-        runConfigTests(configIds2, 2);
-    }
-
-    private void runConfigTests(int[] configIds, int contextClientVersion)
-            throws InterruptedException {
-        for (int configId : configIds) {
-            Intent intent = new Intent(InstrumentationRegistry.getTargetContext(),
-                    EglConfigCtsActivity.class);
-            intent.putExtra(EglConfigCtsActivity.CONFIG_ID_EXTRA, configId);
-            intent.putExtra(EglConfigCtsActivity.CONTEXT_CLIENT_VERSION_EXTRA,
-                    contextClientVersion);
-            EglConfigCtsActivity activity = mActivityRule.launchActivity(intent);
-            activity.waitToFinishDrawing();
-            // TODO(b/30948621): Remove the sleep below once b/30948621 is fixed.
-            Thread.sleep(500);
-            activity.finish();
-            mInstrumentation.waitForIdleSync();
-        }
-    }
-
-    private static int[] getEglConfigIds(int renderableType) {
-        EGL10 egl = (EGL10) EGLContext.getEGL();
-        EGLDisplay display = egl.eglGetDisplay(EGL10.EGL_DEFAULT_DISPLAY);
-        int[] numConfigs = new int[1];
-
-        int[] attributeList = new int[] {
-                EGL10.EGL_RENDERABLE_TYPE, renderableType,
-
-                // Avoid configs like RGBA0008 which crash even though they have the window bit set.
-                EGL10.EGL_RED_SIZE, 1,
-                EGL10.EGL_GREEN_SIZE, 1,
-                EGL10.EGL_BLUE_SIZE, 1,
-
-                EGL10.EGL_SURFACE_TYPE, EGL10.EGL_WINDOW_BIT,
-                EGL10.EGL_NONE
-        };
-
-        if (egl.eglInitialize(display, null)) {
-            try {
-                if (egl.eglChooseConfig(display, attributeList, null, 0, numConfigs)) {
-                    EGLConfig[] configs = new EGLConfig[numConfigs[0]];
-                    if (egl.eglChooseConfig(display, attributeList, configs, configs.length,
-                            numConfigs)) {
-                        int[] configIds = new int[numConfigs[0]];
-                        for (int i = 0; i < numConfigs[0]; i++) {
-                            int[] value = new int[1];
-                            if (egl.eglGetConfigAttrib(display, configs[i], EGL10.EGL_CONFIG_ID,
-                                    value)) {
-                                configIds[i] = value[0];
-                            } else {
-                              throw new IllegalStateException("Couldn't call eglGetConfigAttrib");
-                            }
-                        }
-                        return configIds;
-                    } else {
-                        throw new IllegalStateException("Couldn't call eglChooseConfig (1)");
-                    }
-                } else {
-                    throw new IllegalStateException("Couldn't call eglChooseConfig (2)");
-                }
-            } finally {
-                egl.eglTerminate(display);
-            }
-        } else {
-            throw new IllegalStateException("Couldn't initialize EGL.");
-        }
+        Intent intent = new Intent(InstrumentationRegistry.getTargetContext(),
+                EglConfigCtsActivity.class);
+        EglConfigCtsActivity activity = mActivityRule.launchActivity(intent);
+        activity.waitToFinishTesting();
+        activity.finish();
+        mInstrumentation.waitForIdleSync();
     }
 }
diff --git a/tests/tests/permission2/res/raw/automotive_android_manifest.xml b/tests/tests/permission2/res/raw/automotive_android_manifest.xml
index fac07894d45..47d25094294 100644
--- a/tests/tests/permission2/res/raw/automotive_android_manifest.xml
+++ b/tests/tests/permission2/res/raw/automotive_android_manifest.xml
@@ -281,6 +281,12 @@
         android:label="@string/car_permission_label_enroll_trust"
         android:description="@string/car_permission_desc_enroll_trust" />
 
+    <permission
+        android:name="android.car.permission.CAR_TEST_SERVICE"
+        android:protectionLevel="privileged|signature"
+        android:label="@string/car_permission_label_car_test_service"
+        android:description="@string/car_permission_desc_car_test_service" />
+
     <uses-permission android:name="android.permission.CALL_PHONE" />
     <uses-permission android:name="android.permission.DEVICE_POWER" />
     <uses-permission android:name="android.permission.GRANT_RUNTIME_PERMISSIONS" />
diff --git a/tests/tests/security/res/raw/bug_33090864_avc.mp4 b/tests/tests/security/res/raw/bug_33090864_avc.mp4
new file mode 100644
index 00000000000..f8e2a2788c0
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_33090864_avc.mp4
diff --git a/tests/tests/security/res/raw/bug_33090864_framelen.mp4 b/tests/tests/security/res/raw/bug_33090864_framelen.mp4
new file mode 100644
index 00000000000..ffaa6ac5770
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_33090864_framelen.mp4
@@ -0,0 +1,4 @@
+45
+3058
+651
+2281
\ No newline at end of file
diff --git a/tests/tests/security/res/raw/cve_2017_13204_avc.mp4 b/tests/tests/security/res/raw/cve_2017_13204_avc.mp4
new file mode 100644
index 00000000000..a627ec67347
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2017_13204_avc.mp4
diff --git a/tests/tests/security/res/raw/cve_2017_13204_framelen.mp4 b/tests/tests/security/res/raw/cve_2017_13204_framelen.mp4
new file mode 100644
index 00000000000..5fc9458a91a
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2017_13204_framelen.mp4
@@ -0,0 +1,98 @@
+22
+130
+83
+102
+85
+97
+73
+86
+79
+80
+69
+80
+78
+82
+81
+77
+65
+85
+83
+91
+72
+88
+74
+87
+72
+66
+66
+77
+74
+94
+66
+59
+59
+70
+64
+76
+59
+88
+59
+83
+75
+72
+72
+92
+83
+77
+52
+66
+57
+57
+58
+91
+69
+86
+67
+63
+68
+89
+73
+72
+69
+58
+65
+79
+82
+0
+239
+189
+168
+151
+137
+142
+156
+127
+149
+157
+152
+151
+113
+133
+158
+104
+114
+138
+144
+147
+126
+157
+132
+107
+100
+165
+154
+112
+164
+131
+111
+143
\ No newline at end of file
diff --git a/tests/tests/security/src/android/security/cts/ServicePermissionsTest.java b/tests/tests/security/src/android/security/cts/ServicePermissionsTest.java
index 60e27e62544..bccbe59f88a 100644
--- a/tests/tests/security/src/android/security/cts/ServicePermissionsTest.java
+++ b/tests/tests/security/src/android/security/cts/ServicePermissionsTest.java
@@ -107,6 +107,7 @@ public class ServicePermissionsTest extends AndroidTestCase {
             } catch (SecurityException e) {
                 String msg = e.getMessage();
                 if ((msg == null) || msg.contains("android.permission.DUMP")) {
+                    Log.d(TAG, "Service " + service + " correctly checked permission");
                     // Service correctly checked for DUMP permission, yay
                 } else {
                     // Service is throwing about something else; they're
@@ -115,7 +116,9 @@ public class ServicePermissionsTest extends AndroidTestCase {
                     continue;
                 }
             } catch (TransactionTooLargeException | DeadObjectException e) {
-                // SELinux likely prevented the dump - assume safe
+                // SELinux likely prevented the dump - assume safe, but log anywasy
+                // (as the exception might happens in some devices but not on others)
+                Log.w(TAG, "Service " + service + " threw exception: " + e);
                 continue;
             } finally {
                 out.close();
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index 7cc3fe6780a..cd0018d7c6b 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -815,6 +815,11 @@ public class StagefrightTest extends InstrumentationTestCase {
      to prevent merge conflicts, add N tests below this comment,
      before any existing test methods
      ***********************************************************/
+    @SecurityTest(minPatchLevel = "2017-03")
+    public void testBug_33090864() throws Exception {
+        int[] frameSizes = getFrameSizes(R.raw.bug_33090864_framelen);
+        doStagefrightTestRawBlob(R.raw.bug_33090864_avc, "video/avc", 320, 240, frameSizes);
+    }
 
     @SecurityTest(minPatchLevel = "2017-07")
     public void testStagefright_bug_36279112() throws Exception {
@@ -1116,6 +1121,11 @@ public class StagefrightTest extends InstrumentationTestCase {
         doStagefrightTest(R.raw.cve_2019_2334);
     }
 
+    public void testStagefright_cve_2017_13204() throws Exception {
+        int[] frameSizes = getFrameSizes(R.raw.cve_2017_13204_framelen);
+        doStagefrightTestRawBlob(R.raw.cve_2017_13204_avc, "video/avc", 16, 16, frameSizes);
+    }
+
     @SecurityTest(minPatchLevel = "2018-03")
     public void testStagefright_cve_2017_17773() throws Exception {
         doStagefrightTest(R.raw.cve_2017_17773);
diff --git a/tests/tests/telecom4/Android.mk b/tests/tests/telecom4/Android.mk
new file mode 100644
index 00000000000..2fc8558f079
--- /dev/null
+++ b/tests/tests/telecom4/Android.mk
@@ -0,0 +1,40 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+
+# don't include this package in any target
+LOCAL_MODULE_TAGS := optional
+# and when built explicitly put it in the data partition
+LOCAL_MODULE_PATH := $(TARGET_OUT_DATA_APPS)
+
+LOCAL_STATIC_JAVA_LIBRARIES := \
+    ctstestrunner-axt \
+    compatibility-device-util-axt
+
+LOCAL_SRC_FILES := $(call all-java-files-under, src)
+
+LOCAL_PACKAGE_NAME := CtsTelecom4TestCases
+LOCAL_SDK_VERSION := current
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts vts general-tests
+
+LOCAL_JAVA_LIBRARIES += android.test.runner.stubs
+LOCAL_JAVA_LIBRARIES += android.test.base.stubs
+
+include $(BUILD_CTS_PACKAGE)
diff --git a/tests/tests/telecom4/AndroidManifest.xml b/tests/tests/telecom4/AndroidManifest.xml
new file mode 100644
index 00000000000..a887fdfbf65
--- /dev/null
+++ b/tests/tests/telecom4/AndroidManifest.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright (C) 2019 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.telecom4.cts">
+
+    <application>
+        <uses-library android:name="android.test.runner" />
+    </application>
+
+    <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+                     android:targetPackage="android.telecom4.cts">
+        <meta-data android:name="listener"
+            android:value="com.android.cts.runner.CtsTestRunListener" />
+    </instrumentation>
+
+</manifest>
+
diff --git a/tests/tests/telecom4/AndroidTest.xml b/tests/tests/telecom4/AndroidTest.xml
new file mode 100644
index 00000000000..ae5ad5bdd13
--- /dev/null
+++ b/tests/tests/telecom4/AndroidTest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright (C) 2019 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<configuration description="Config for CTS Telecom test cases">
+    <option name="test-suite-tag" value="cts" />
+    <option name="config-descriptor:metadata" key="component" value="telecom" />
+    <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
+    <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
+    <option name="not-shardable" value="true" />
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true" />
+        <option name="test-file-name" value="CtsTelecom4TestCases.apk" />
+    </target_preparer>
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
+        <option name="package" value="android.telecom4.cts" />
+        <option name="runtime-hint" value="7m30s" />
+    </test>
+</configuration>
diff --git a/tests/tests/telecom4/OWNERS b/tests/tests/telecom4/OWNERS
new file mode 100644
index 00000000000..93fe55550f8
--- /dev/null
+++ b/tests/tests/telecom4/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 20868
+
diff --git a/tests/tests/telecom4/src/android/telecom4/cts/InCallServiceImplTest.java b/tests/tests/telecom4/src/android/telecom4/cts/InCallServiceImplTest.java
new file mode 100644
index 00000000000..0e68c640f2f
--- /dev/null
+++ b/tests/tests/telecom4/src/android/telecom4/cts/InCallServiceImplTest.java
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.telecom4.cts;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
+import android.util.Log;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.compatibility.common.util.CddTest;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Build, install and run the tests by running the commands below:
+ * make CtsTelecom4TestCases -j64
+ * cts-tradefed run cts -m CtsTelecom4TestCases --test android.telecom4.cts.InCallServiceImplTest
+ */
+@RunWith(AndroidJUnit4.class)
+public class InCallServiceImplTest {
+    private static final String TAG = "InCallServiceTest";
+    private static final String IN_CALL_SERVICE_ACTION = "android.telecom.InCallService";
+    private static final String IN_CALL_SERVICE_PERMISSION =
+            "android.permission.BIND_INCALL_SERVICE";
+
+    private Context mContext;
+    private PackageManager mPackageManager;
+
+    @Before
+    public void setup() {
+        mContext = InstrumentationRegistry.getContext();
+        mPackageManager = mContext.getPackageManager();
+    }
+
+    @CddTest(requirement = "7.4.1.2/C-1-3")
+    @Test
+    public void resolveInCallIntent() {
+        if (!hasTelephonyFeature()) {
+            Log.d(TAG, "Bypass the test since telephony is not available.");
+            return;
+        }
+
+        Intent intent = new Intent();
+        intent.setAction(IN_CALL_SERVICE_ACTION);
+        ResolveInfo resolveInfo = mPackageManager.resolveService(intent,
+                PackageManager.GET_SERVICES | PackageManager.GET_META_DATA);
+
+        assertNotNull(resolveInfo);
+        assertNotNull(resolveInfo.serviceInfo);
+        assertNotNull(resolveInfo.serviceInfo.packageName);
+        assertNotNull(resolveInfo.serviceInfo.name);
+        assertEquals(IN_CALL_SERVICE_PERMISSION, resolveInfo.serviceInfo.permission);
+    }
+
+    private boolean hasTelephonyFeature() {
+        return mPackageManager.hasSystemFeature(PackageManager.FEATURE_TELEPHONY);
+    }
+}
diff --git a/tests/tests/voicesettings/src/android/voicesettings/cts/AirplaneModeTest.java b/tests/tests/voicesettings/src/android/voicesettings/cts/AirplaneModeTest.java
index 2ef1999ef45..9a855cbdae9 100644
--- a/tests/tests/voicesettings/src/android/voicesettings/cts/AirplaneModeTest.java
+++ b/tests/tests/voicesettings/src/android/voicesettings/cts/AirplaneModeTest.java
@@ -89,7 +89,10 @@ public class AirplaneModeTest extends BroadcastTestBase {
     }
 
     private boolean runTest(BroadcastUtils.TestcaseType test, int expectedMode) throws Exception {
-        if (!startTestAndWaitForBroadcast(test, VOICE_SETTINGS_PACKAGE, VOICE_INTERACTION_CLASS)) {
+        if (!startTestAndWaitForChange(test,
+                Settings.Global.getUriFor(Settings.Global.AIRPLANE_MODE_ON),
+                VOICE_SETTINGS_PACKAGE,
+                VOICE_INTERACTION_CLASS)) {
             return false;
         }
 
diff --git a/tests/tests/voicesettings/src/android/voicesettings/cts/ZenModeTest.java b/tests/tests/voicesettings/src/android/voicesettings/cts/ZenModeTest.java
index e01f3b9a587..e157ad00d41 100644
--- a/tests/tests/voicesettings/src/android/voicesettings/cts/ZenModeTest.java
+++ b/tests/tests/voicesettings/src/android/voicesettings/cts/ZenModeTest.java
@@ -92,7 +92,9 @@ public class ZenModeTest extends BroadcastTestBase {
     }
 
     private boolean runTest(BroadcastUtils.TestcaseType test, int expectedMode) throws Exception {
-        if (!startTestAndWaitForBroadcast(test, VOICE_SETTINGS_PACKAGE, VOICE_INTERACTION_CLASS)) {
+        if (!startTestAndWaitForChange(test,
+                Settings.Global.getUriFor(ZEN_MODE), VOICE_SETTINGS_PACKAGE,
+                VOICE_INTERACTION_CLASS)) {
             return false;
         }