Merge cherrypicks of [7982564, 7982192, 7982565, 7981411, 7982522, 7982682, 7982193, 7982194, 7982523, 7982480, 7982623, 7981412, 7981413, 7982605, 7982606, 7982607, 7982608, 7981749, 7981750, 7981751, 7981752, 7981753, 7981754, 7982624, 7982394, 7982395, 7982625, 7982687, 7982566, 7982567, 7982568, 7982688, 7982689, 7982690, 7982195, 7982196, 7982611, 7982612, 7982396, 7982694, 7982695, 7982215] into pi-qpr3-releaseandroid-9.0.0_r46pie-qpr3-release

Change-Id: I0d9dddc417fa1887e03ddc9d444a8b7894c5b678

10 files changed, 306 insertions, 2 deletions

diff --git a/tests/tests/os/Android.mk b/tests/tests/os/Android.mk
index 9cd0b87c845..a77fd797dbd 100644
--- a/tests/tests/os/Android.mk
+++ b/tests/tests/os/Android.mk
@@ -40,7 +40,8 @@ LOCAL_SRC_FILES := \
     src/android/os/cts/IEmptyService.aidl \
     src/android/os/cts/ISeccompIsolatedService.aidl \
     src/android/os/cts/ISecondary.aidl \
-    src/android/os/cts/ISharedMemoryService.aidl
+    src/android/os/cts/ISharedMemoryService.aidl \
+    src/android/os/cts/IParcelExceptionService.aidl \
 
 LOCAL_PACKAGE_NAME := CtsOsTestCases
 
diff --git a/tests/tests/os/AndroidManifest.xml b/tests/tests/os/AndroidManifest.xml
index 0644dd077e7..fd0750f519e 100644
--- a/tests/tests/os/AndroidManifest.xml
+++ b/tests/tests/os/AndroidManifest.xml
@@ -80,6 +80,10 @@
             android:name="android.os.cts.SharedMemoryService"
             android:process=":sharedmem"
             android:exported="false" />
+        <service
+            android:name="android.os.cts.ParcelExceptionService"
+            android:process=":remote"
+            android:exported="true" />
 
         <service android:name="android.os.cts.LocalService">
             <intent-filter>
diff --git a/tests/tests/os/src/android/os/cts/ExceptionalParcelable.aidl b/tests/tests/os/src/android/os/cts/ExceptionalParcelable.aidl
new file mode 100644
index 00000000000..7d0969340cd
--- /dev/null
+++ b/tests/tests/os/src/android/os/cts/ExceptionalParcelable.aidl
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.os.cts;
+
+parcelable ExceptionalParcelable;
\ No newline at end of file
diff --git a/tests/tests/os/src/android/os/cts/ExceptionalParcelable.java b/tests/tests/os/src/android/os/cts/ExceptionalParcelable.java
new file mode 100644
index 00000000000..333cf57e8cf
--- /dev/null
+++ b/tests/tests/os/src/android/os/cts/ExceptionalParcelable.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package android.os.cts;
+
+import android.os.IBinder;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+
+public class ExceptionalParcelable implements Parcelable {
+    private final IBinder mBinder;
+
+    ExceptionalParcelable(IBinder binder) {
+        mBinder = binder;
+    }
+
+    public int describeContents() {
+        return 0;
+    }
+
+    /**
+     * Write a binder to the Parcel and then throw an exception
+     */
+    public void writeToParcel(Parcel out, int flags) {
+        // Write a binder for the exception to overwrite
+        out.writeStrongBinder(mBinder);
+
+        // Throw an exception
+        throw new IllegalArgumentException("A truly exceptional message");
+    }
+
+    public static final Creator<ExceptionalParcelable> CREATOR =
+            new Creator<ExceptionalParcelable>() {
+                @Override
+                public ExceptionalParcelable createFromParcel(Parcel source) {
+                    return new ExceptionalParcelable(source.readStrongBinder());
+                }
+
+                @Override
+                public ExceptionalParcelable[] newArray(int size) {
+                    return new ExceptionalParcelable[size];
+                }
+            };
+}
diff --git a/tests/tests/os/src/android/os/cts/IParcelExceptionService.aidl b/tests/tests/os/src/android/os/cts/IParcelExceptionService.aidl
new file mode 100644
index 00000000000..ce7af6deece
--- /dev/null
+++ b/tests/tests/os/src/android/os/cts/IParcelExceptionService.aidl
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.os.cts;
+import android.os.cts.ExceptionalParcelable;
+
+interface IParcelExceptionService {
+//parcelable android.os.cts.ExceptionalParcelable;
+    ExceptionalParcelable writeBinderThrowException();
+}
diff --git a/tests/tests/os/src/android/os/cts/ParcelExceptionService.java b/tests/tests/os/src/android/os/cts/ParcelExceptionService.java
new file mode 100644
index 00000000000..d8387e30d41
--- /dev/null
+++ b/tests/tests/os/src/android/os/cts/ParcelExceptionService.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package android.os.cts;
+
+import android.app.Service;
+import android.content.Intent;
+import android.os.Binder;
+import android.os.IBinder;
+import android.os.RemoteException;
+
+public class ParcelExceptionService extends Service {
+    @Override
+    public IBinder onBind(Intent intent) {
+        return new ParcelExceptionServiceImpl();
+    }
+
+    private static class ParcelExceptionServiceImpl extends IParcelExceptionService.Stub {
+        private final IBinder mBinder = new Binder();
+
+
+        @Override
+        public ExceptionalParcelable writeBinderThrowException() throws RemoteException {
+            return new ExceptionalParcelable(mBinder);
+        }
+    }
+}
diff --git a/tests/tests/os/src/android/os/cts/ParcelTest.java b/tests/tests/os/src/android/os/cts/ParcelTest.java
index 987ab0024ab..50dbf67734a 100644
--- a/tests/tests/os/src/android/os/cts/ParcelTest.java
+++ b/tests/tests/os/src/android/os/cts/ParcelTest.java
@@ -24,7 +24,14 @@ import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
-
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.ServiceConnection;
 import android.content.pm.Signature;
 import android.os.BadParcelableException;
 import android.os.Binder;
@@ -39,6 +46,8 @@ import android.util.Log;
 import android.util.SparseArray;
 import android.util.SparseBooleanArray;
 
+import com.google.common.util.concurrent.AbstractFuture;
+
 public class ParcelTest extends AndroidTestCase {
 
     public void testObtain() {
@@ -3283,4 +3292,55 @@ public class ParcelTest extends AndroidTestCase {
             // good
         }
     }
+
+    public static class ParcelExceptionConnection extends AbstractFuture<IParcelExceptionService>
+            implements ServiceConnection {
+        @Override
+        public void onServiceConnected(ComponentName name, IBinder service) {
+            set(IParcelExceptionService.Stub.asInterface(service));
+        }
+
+        @Override
+        public void onServiceDisconnected(ComponentName name) {
+        }
+
+        @Override
+        public IParcelExceptionService get() throws InterruptedException, ExecutionException {
+            try {
+                return get(5, TimeUnit.SECONDS);
+            } catch (TimeoutException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    public void testExceptionOverwritesObject() throws Exception {
+        final Intent intent = new Intent();
+        intent.setComponent(new ComponentName(
+                "android.os.cts", "android.os.cts.ParcelExceptionService"));
+
+        final ParcelExceptionConnection connection = new ParcelExceptionConnection();
+
+        mContext.startService(intent);
+        assertTrue(mContext.bindService(intent, connection,
+                Context.BIND_ABOVE_CLIENT | Context.BIND_EXTERNAL_SERVICE));
+
+
+        Parcel data = Parcel.obtain();
+        Parcel reply = Parcel.obtain();
+        data.writeInterfaceToken("android.os.cts.IParcelExceptionService");
+        IParcelExceptionService service = connection.get();
+        try {
+            assertTrue("Transaction failed", service.asBinder().transact(
+                    IParcelExceptionService.Stub.TRANSACTION_writeBinderThrowException, data, reply,
+                    0));
+        } catch (Exception e) {
+            fail("Exception caught from transaction: " + e);
+        }
+        reply.setDataPosition(0);
+        assertTrue("Exception should have occurred on service-side",
+                reply.readExceptionCode() != 0);
+        assertNull("Binder should have been overwritten by the exception",
+                reply.readStrongBinder());
+    }
 }
diff --git a/tests/tests/security/res/raw/bug_73552574_avc.mp4 b/tests/tests/security/res/raw/bug_73552574_avc.mp4
new file mode 100644
index 00000000000..1cca70ced45
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_73552574_avc.mp4
diff --git a/tests/tests/security/res/raw/bug_73552574_framelen.mp4 b/tests/tests/security/res/raw/bug_73552574_framelen.mp4
new file mode 100644
index 00000000000..36728cc8ff7
--- /dev/null
+++ b/tests/tests/security/res/raw/bug_73552574_framelen.mp4
@@ -0,0 +1,93 @@
+48
+4
+28
+208
+0
+10
+39
+386
+8
+70
+6
+32
+31
+4
+8
+24
+10
+22
+12
+108
+9
+229
+38
+12
+10
+166
+39
+250
+43
+8
+70
+6
+29
+12
+4
+8
+33
+12
+0
+10
+156
+10
+39
+94
+10
+39
+386
+8
+70
+6
+10
+31
+4
+8
+24
+10
+22
+12
+70
+9
+420
+0
+8
+36
+6
+12
+20
+31
+102
+229
+38
+12
+10
+156
+10
+39
+197
+251
+38
+12
+10
+156
+10
+180
+10
+39
+386
+8
+70
+6
+32
+31
+6441
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index 2b86cb14424..6adac6d21ae 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -788,6 +788,12 @@ public class StagefrightTest extends InstrumentationTestCase {
      before any existing test methods
      ***********************************************************/
 
+    @SecurityTest(minPatchLevel = "2018-06")
+    public void testBug_73552574() throws Exception {
+        int[] frameSizes = getFrameSizes(R.raw.bug_73552574_framelen);
+        doStagefrightTestRawBlob(R.raw.bug_73552574_avc, "video/avc", 320, 240, frameSizes);
+    }
+
     @SecurityTest(minPatchLevel = "2018-02")
     public void testStagefright_bug_68342866() throws Exception {
         Thread server = new Thread() {