Snap for 5715241 from f92db984416ec02a2b5cdf2c40b4cdf0ffe6203a to qt-aml-releaseandroid-mainline-10.0.0_r3android-mainline-10.0.0_r1android10-mainline-release

Change-Id: Iba792f2de0c5fc76be50199d6370838a6b7d44e4

15 files changed, 208 insertions, 30 deletions

diff --git a/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java b/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
index 3ea6b637686..be9130805c9 100644
--- a/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
+++ b/common/device-side/util/src/com/android/compatibility/common/util/MediaUtils.java
@@ -20,6 +20,7 @@ import android.content.res.AssetFileDescriptor;
 import android.drm.DrmConvertedStatus;
 import android.drm.DrmManagerClient;
 import android.graphics.ImageFormat;
+import android.graphics.Rect;
 import android.media.Image;
 import android.media.Image.Plane;
 import android.media.MediaCodec;
@@ -1154,36 +1155,46 @@ public class MediaUtils {
 
         MessageDigest md = MessageDigest.getInstance("MD5");
 
-        int imageWidth = image.getWidth();
-        int imageHeight = image.getHeight();
+        Rect crop = image.getCropRect();
+        int cropLeft = crop.left;
+        int cropRight = crop.right;
+        int cropTop = crop.top;
+        int cropBottom = crop.bottom;
+
+        int imageWidth = cropRight - cropLeft + 1;
+        int imageHeight = cropBottom - cropTop + 1;
 
         Image.Plane[] planes = image.getPlanes();
         for (int i = 0; i < planes.length; ++i) {
             ByteBuffer buf = planes[i].getBuffer();
 
-            int width, height, rowStride, pixelStride, x, y;
+            int width, height, rowStride, pixelStride, x, y, top, left;
             rowStride = planes[i].getRowStride();
             pixelStride = planes[i].getPixelStride();
             if (i == 0) {
                 width = imageWidth;
                 height = imageHeight;
+                left = cropLeft;
+                top = cropTop;
             } else {
                 width = imageWidth / 2;
                 height = imageHeight /2;
+                left = cropLeft / 2;
+                top = cropTop / 2;
             }
             // local contiguous pixel buffer
             byte[] bb = new byte[width * height];
             if (buf.hasArray()) {
                 byte b[] = buf.array();
-                int offs = buf.arrayOffset();
+                int offs = buf.arrayOffset() + left * pixelStride;
                 if (pixelStride == 1) {
                     for (y = 0; y < height; ++y) {
-                        System.arraycopy(bb, y * width, b, y * rowStride + offs, width);
+                        System.arraycopy(bb, y * width, b, (top + y) * rowStride + offs, width);
                     }
                 } else {
                     // do it pixel-by-pixel
                     for (y = 0; y < height; ++y) {
-                        int lineOffset = offs + y * rowStride;
+                        int lineOffset = offs + (top + y) * rowStride;
                         for (x = 0; x < width; ++x) {
                             bb[y * width + x] = b[lineOffset + x * pixelStride];
                         }
@@ -1193,7 +1204,7 @@ public class MediaUtils {
                 int pos = buf.position();
                 if (pixelStride == 1) {
                     for (y = 0; y < height; ++y) {
-                        buf.position(pos + y * rowStride);
+                        buf.position(pos + left + (top + y) * rowStride);
                         buf.get(bb, y * width, width);
                     }
                 } else {
@@ -1201,7 +1212,7 @@ public class MediaUtils {
                     byte[] lb = new byte[rowStride];
                     // do it pixel-by-pixel
                     for (y = 0; y < height; ++y) {
-                        buf.position(pos + y * rowStride);
+                        buf.position(pos + left * pixelStride + (top + y) * rowStride);
                         // we're only guaranteed to have pixelStride * (width - 1) + 1 bytes
                         buf.get(lb, 0, pixelStride * (width - 1) + 1);
                         for (x = 0; x < width; ++x) {
diff --git a/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java b/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
index 09282b3ed02..e67400806d0 100644..100755
--- a/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
+++ b/hostsidetests/devicepolicy/app/MeteredDataTestApp/src/com/android/cts/devicepolicy/metereddatatestapp/MainActivity.java
@@ -31,6 +31,7 @@ public class MainActivity extends Activity {
 
     private static final String EXTRA_MESSENGER = "messenger";
     private static final int MSG_NOTIFY_NETWORK_STATE = 1;
+    private static final int WAIT_TO_ALLOW_CONNECTING_MS = 2000;
 
     @Override
     public void onCreate(Bundle icicle) {
@@ -60,6 +61,15 @@ public class MainActivity extends Activity {
     private NetworkInfo getActiveNetworkInfo() {
         final ConnectivityManager cm = (ConnectivityManager) getSystemService(
                 Context.CONNECTIVITY_SERVICE);
+        waitToAllowConnecting();
         return cm.getActiveNetworkInfo();
     }
+
+    private void waitToAllowConnecting() {
+        try {
+            Thread.sleep(WAIT_TO_ALLOW_CONNECTING_MS);
+        } catch (InterruptedException e) {
+            throw new IllegalStateException(e);
+        }
+    }
 }
diff --git a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
index e69dc5f8789..d6bc90e8763 100644
--- a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
+++ b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/DeviceTestConstants.java
@@ -113,6 +113,6 @@ public final class DeviceTestConstants {
     private static final String NO_OP_TEST =
             "android.inputmethodservice.cts.devicetest.NoOpDeviceTest";
 
-    public static final TestInfo TEST_WAIT_3SEC =
-            new TestInfo(PACKAGE, NO_OP_TEST, "testWait3Sec");
+    public static final TestInfo TEST_WAIT_15SEC =
+            new TestInfo(PACKAGE, NO_OP_TEST, "testWait15Sec");
 }
diff --git a/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java b/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
index 34402ee0afe..dcd79f5ae46 100644
--- a/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
+++ b/hostsidetests/inputmethodservice/deviceside/devicetest/src/android/inputmethodservice/cts/devicetest/NoOpDeviceTest.java
@@ -29,9 +29,9 @@ import org.junit.runner.RunWith;
 @RunWith(AndroidJUnit4.class)
 public class NoOpDeviceTest {
 
-    /** Does nothing but just wait 3 seconds. */
+    /** Does nothing but just wait 15 seconds. */
     @Test
-    public void testWait3Sec() {
-        SystemClock.sleep(3000);
+    public void testWait15Sec() {
+        SystemClock.sleep(15000);
     }
 }
diff --git a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
index af7d944516e..4c2d8846da6 100644
--- a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
+++ b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/MultiUserTest.java
@@ -351,13 +351,13 @@ public class MultiUserTest extends BaseHostJUnit4Test {
             try {
                 // This test should never fail.  If this fails, it means that the system was not yet
                 // ready to run tests in this APK.
-                runTestAsUser(DeviceTestConstants.TEST_WAIT_3SEC, userId);
+                runTestAsUser(DeviceTestConstants.TEST_WAIT_15SEC, userId);
                 return;
             } catch (AssertionError e) {
                 // Ignoring because it can be because of Bug 132082599.
             }
         }
-        runTestAsUser(DeviceTestConstants.TEST_WAIT_3SEC, userId);
+        runTestAsUser(DeviceTestConstants.TEST_WAIT_15SEC, userId);
     }
 
 
diff --git a/tests/tests/media/src/android/media/cts/AudioTrackTest.java b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
index d52dc16f046..fa20770bfa5 100644..100755
--- a/tests/tests/media/src/android/media/cts/AudioTrackTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
@@ -1451,7 +1451,7 @@ public class AudioTrackTest {
         // constant for test
         final String TEST_NAME = "testGetMinBufferSizeTooHighSR";
         // FIXME need an API to retrieve AudioTrack.SAMPLE_RATE_HZ_MAX
-        final int TEST_SR = 192001;
+        final int TEST_SR = AudioFormat.SAMPLE_RATE_HZ_MAX + 1;
         final int TEST_CONF = AudioFormat.CHANNEL_CONFIGURATION_MONO;
         final int TEST_FORMAT = AudioFormat.ENCODING_PCM_8BIT;
 
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecTest.java b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
index 3802110b9cc..7151d365366 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
@@ -2030,6 +2030,7 @@ public class MediaCodecTest extends AndroidTestCase {
         private int mBufOut = 0;
         private int mBufCounter = 0;
 
+        private MediaExtractor mExtractor; // Read from Extractor instead of InputStream
         // helper for bytewise read()
         private byte[] mOneByte = new byte[1];
 
@@ -2072,6 +2073,12 @@ public class MediaCodecTest extends AndroidTestCase {
             mBufferInputStream = input;
         }
 
+        MediaCodecStream(MediaExtractor mediaExtractor,
+                MediaFormat format) throws Exception {
+            this(format, false /* encode */);
+            mExtractor = mediaExtractor;
+        }
+
         @Override
         public ByteBuffer read() throws IOException {
 
@@ -2091,8 +2098,19 @@ public class MediaCodecTest extends AndroidTestCase {
                     buf.clear();
                     int inBufLen = buf.limit();
                     int numRead = 0;
-
-                    if (mBufferInputStream != null) {
+                    long timestampUs = 0; // non-zero for MediaExtractor mode
+                    if (mExtractor != null) {
+                        numRead = mExtractor.readSampleData(buf, 0 /* offset */);
+                        timestampUs = mExtractor.getSampleTime();
+                        Log.v(TAG, "MediaCodecStream.read using Extractor, numRead "
+                                + numRead +" timestamp " + timestampUs);
+                        mExtractor.advance();
+                        if(numRead < 0) {
+                           mSawInputEOS = true;
+                           timestampUs = 0;
+                           numRead =0;
+                        }
+                    } else if (mBufferInputStream != null) {
                         ByteBuffer in = null;
                         do {
                             in = mBufferInputStream.read();
@@ -2122,7 +2140,7 @@ public class MediaCodecTest extends AndroidTestCase {
                     }
 
                     int flags = mSawInputEOS ? MediaCodec.BUFFER_FLAG_END_OF_STREAM : 0;
-                    if (!mEncode && !mSentConfig) {
+                    if (!mEncode && !mSentConfig && mExtractor == null) {
                         flags |= MediaCodec.BUFFER_FLAG_CODEC_CONFIG;
                         mSentConfig = true;
                     }
@@ -2132,7 +2150,7 @@ public class MediaCodecTest extends AndroidTestCase {
                     mCodec.queueInputBuffer(index,
                             0 /* offset */,
                             numRead,
-                            0 /* presentationTimeUs */,
+                            timestampUs /* presentationTimeUs */,
                             flags);
                     Log.i(TAG, "queued input buffer " + index + ", size " + numRead);
                 }
diff --git a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
index 0a6ab99f1c5..67de7979a2c 100644
--- a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
@@ -399,9 +399,10 @@ public class MediaExtractorTest extends AndroidTestCase {
         public MediaFormat mFormat;
 
         private MediaExtractor mExtractor;
+        private MediaCodecTest.MediaCodecStream mDecoderStream;
 
         public MediaExtractorStream(
-                String mime,
+                String inMime, String outMime,
                 MediaDataSource dataSource) throws Exception {
             mExtractor = new MediaExtractor();
             mExtractor.setDataSource(dataSource);
@@ -411,23 +412,26 @@ public class MediaExtractorTest extends AndroidTestCase {
             for (int i = 0; i < numTracks; ++i) {
                 final MediaFormat format = mExtractor.getTrackFormat(i);
                 final String actualMime = format.getString(MediaFormat.KEY_MIME);
-                if (mime.equals(actualMime)) {
-                    mExtractor.selectTrack(i);
-                    mFormat = format;
+                mExtractor.selectTrack(i);
+                mFormat = format;
+                if (outMime.equals(actualMime)) {
                     break;
+                } else { // no matching mime, try to use decoder
+                    mDecoderStream = new MediaCodecTest.MediaCodecStream(
+                            mExtractor, mFormat);
+                    Log.w(TAG, "fallback to input mime type with decoder");
                 }
             }
-            assertNotNull("MediaExtractor cannot find mime type " + mime, mFormat);
+            assertNotNull("MediaExtractor cannot find mime type " + inMime, mFormat);
             mIsFloat = mFormat.getInteger(
                     MediaFormat.KEY_PCM_ENCODING, AudioFormat.ENCODING_PCM_16BIT)
                             == AudioFormat.ENCODING_PCM_FLOAT;
-
         }
 
         public MediaExtractorStream(
-                String mime,
+                String inMime, String outMime,
                 MediaCodecTest.ByteBufferStream inputStream) throws Exception {
-            this(mime, new ByteBufferDataSource(inputStream));
+            this(inMime, outMime, new ByteBufferDataSource(inputStream));
         }
 
         @Override
@@ -435,7 +439,9 @@ public class MediaExtractorTest extends AndroidTestCase {
             if (mSawOutputEOS) {
                 return null;
             }
-
+            if (mDecoderStream != null) {
+                return mDecoderStream.read();
+            }
             // To preserve codec-like behavior, we create ByteBuffers
             // equal to the media sample size.
             final long size = mExtractor.getSampleSize();
@@ -500,7 +506,8 @@ public class MediaExtractorTest extends AndroidTestCase {
                             new MediaCodecTest.ByteBufferInputStream(audioStream),
                             format, true /* encode */);
             final MediaExtractorStream flacToRaw =
-                    new MediaExtractorStream("audio/raw", rawToFlac);
+                    new MediaExtractorStream(MediaFormat.MIMETYPE_AUDIO_FLAC /* inMime */,
+                            MediaFormat.MIMETYPE_AUDIO_RAW /* outMime */, rawToFlac);
 
             // Note: the existence of signed zero (as well as NAN) may make byte
             // comparisons invalid for floating point output. In our case, since the
diff --git a/tests/tests/security/AndroidManifest.xml b/tests/tests/security/AndroidManifest.xml
index df94dfe83cb..42074447d39 100644
--- a/tests/tests/security/AndroidManifest.xml
+++ b/tests/tests/security/AndroidManifest.xml
@@ -49,6 +49,15 @@
                 <category android:name="android.intent.category.FRAMEWORK_INSTRUMENTATION_TEST"/>
             </intent-filter>
         </activity>
+
+        <activity
+            android:name="android.security.cts.SkiaJpegDecodingActivity"
+            android:label="Test overflow in libskia JPG processing">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN"/>
+                <category android:name="android.intent.category.FRAMEWORK_INSTRUMENTATION_TEST"/>
+            </intent-filter>
+        </activity>
     </application>
 
     <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
diff --git a/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg b/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg
new file mode 100644
index 00000000000..f63f6ef348a
--- /dev/null
+++ b/tests/tests/security/res/drawable/signal_sigsegv_in_jmem_ashmem.jpg
diff --git a/tests/tests/security/res/layout/activity_skiajpegdecoding.xml b/tests/tests/security/res/layout/activity_skiajpegdecoding.xml
new file mode 100644
index 00000000000..68a0d68c99f
--- /dev/null
+++ b/tests/tests/security/res/layout/activity_skiajpegdecoding.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="fill_parent"
+    android:layout_height="fill_parent"
+    android:gravity="center"
+    android:orientation="vertical">
+
+    <ImageView
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:src="@drawable/signal_sigsegv_in_jmem_ashmem"
+        />
+
+</LinearLayout>
\ No newline at end of file
diff --git a/tests/tests/security/res/raw/bug_113260892_hevc.mp4 b/tests/tests/security/res/raw/bug_113260892_hevc.mp4
new file mode 100644
index 00000000000..6dfebba67d2
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_113260892_hevc.mp4
diff --git a/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java
new file mode 100644
index 00000000000..828978419d1
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingActivity.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.app.Activity;
+import android.os.Bundle;
+
+import android.security.cts.R;
+
+public class SkiaJpegDecodingActivity extends Activity {
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+    }
+}
diff --git a/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java
new file mode 100644
index 00000000000..55525e086a6
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/SkiaJpegDecodingTest.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.app.Activity;
+import android.test.ActivityInstrumentationTestCase2;
+
+public class SkiaJpegDecodingTest extends
+        ActivityInstrumentationTestCase2<SkiaJpegDecodingActivity> {
+    private Activity mActivity;
+
+    public SkiaJpegDecodingTest() {
+        super(SkiaJpegDecodingActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mActivity = getActivity();
+        assertNotNull("Failed to get the activity instance", mActivity);
+    }
+
+    public void testLibskiaOverFlowJpegProcessing() {
+      // When this is run on a vulnerable build the app will have a native crash
+      // which will fail the test. When it is run on a non-vulnerable build we may
+      // get a java-level exception, indicating that the error was handled properly
+      mActivity.runOnUiThread(new Runnable() {
+          public void run() {
+            try {
+              mActivity.setContentView(R.layout.activity_skiajpegdecoding);
+            } catch (android.view.InflateException e) {
+              return;
+            }
+          }
+        });
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        if (mActivity != null) {
+            mActivity.finish();
+        }
+        super.tearDown();
+    }
+}
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index a39941c074d..b806e1b2a72 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -810,6 +810,11 @@ public class StagefrightTest extends InstrumentationTestCase {
         doStagefrightTestRawBlob(R.raw.bug_73552574_avc, "video/avc", 320, 240, frameSizes);
     }
 
+    @SecurityTest(minPatchLevel = "2018-12")
+    public void testBug_113260892() throws Exception {
+        doStagefrightTestRawBlob(R.raw.bug_113260892_hevc, "video/hevc", 320, 240);
+    }
+
     @SecurityTest(minPatchLevel = "2018-02")
     public void testStagefright_bug_68342866() throws Exception {
         Thread server = new Thread() {