GitLab

Corrupt files could cause very large allocations, limit them to something
more reasonable.

Bug: 17769851
Change-Id: Ib0f722fd6fddff873bd7a547aac456e608c34c84

IAudioFlinger: fix the missing initialization of variable to ensure no info leak when writing them to Parcel.

Bug: 23953967
Change-Id: I3a1d0144ba3832649e322c197ff0f03305ee7829
(cherry picked from commit 4cac44b5)

DO NOT MERGE - IAudioFlinger: always initialize variables to ensure no info leak when writing them to Parcel.

Bug: 23953967
Change-Id: Ibbe841da149038675e9e8daea76c77558bc8564b
(cherry picked from commit 983dca39)

bug: 23600291
Change-Id: I7979e9e25ada01c13775be8580d433a8b4ce4ffe

bug: 23540426
Change-Id: I7ca419e4008967a0387649e5293ac9d4be71d3c4

Switch to foundation base64 function in OggExtractor and fix the
issue there.

This reverts commit 28314aef.

Bug: 23707088
Change-Id: I268bd50431de5b5e579343bf1b425c42ada6daba

Bug: 23905951
Bug: 23912202
Change-Id: Id13a9d3cae2c09e7381b841e67ddfb188274d74c
(cherry picked from commit e995e477)

Also remove some CHECK's.

Bug: 23680780
Change-Id: I62d0941e203e40209fa6fbe3f923f3efdc5a6c23
(cherry picked from commit 7bb772e0)

Bug: 23707088
Change-Id: I8d32841fee3213c721cdcc57788807ea64d19d74

More specifically when handling GET_OUTPUT_FOR_ATTR in IAudioPolicyService.
This prevents leaking a uninitialized `output` across binder if
getOutputForAttr were to encounter errors.

Bug: 23756261
Change-Id: Ibff8a1249a4e8a3c89a33a540dda428b10d6ca82

More specifically when handling:
* GET_STREAM_VOLUME in IAudioPolicyService, and
* GET_CURRENT_POSITION and GET_DURATION in IMediaPlayer

This prevents leaking uninitialized values across binder in error cases.

Bug: 23756261
Change-Id: I0ffd900ab12b685b0611259ade4a3efb1ec5defe

Bug: 23540907
Change-Id: If30cfa535ad51521053706fc40fc98d893db5bc7
(cherry picked from commit 10e6660c)

Add bounds checking and fix other bugs.

Bug: 23284974
Bug: 23541506
Bug: 23542351
Bug: 23542352
Change-Id: I53551efdf109ce1833e0c361efaf4cee7a851023

Credit https://code.google.com/p/android/issues/detail?id=183310

Bug: 23515142
Change-Id: Idbd66fb148bd0ac1dd78f8651d0164f2a41e2427
(cherry picked from commit b73b826c)

Bug: 23540907
Change-Id: Ib89afc6b273b0eb310bbc5a1bd92b1e3d407c249

Check allocations when the size is read from a file and might therefore
be invalid.

b/14388161

Change-Id: Ia08cc0a6107f275a70e793ef3b50c0ce16ceeee0

bug: 19779574
Change-Id: I4ffe8c3fadc07da211f421e75ee83010b01d9cbb

Bug: 23658148
Change-Id: Ic37cac7b5d166143e0b77e9919b0aaef486e4fdd

Resolved conflicts from cherry-picking ag/764007 into the lmp-mr1-release branch.

This reverts commit d3831760.

Change-Id: I0509f7eadb3a27c4cadbd3088cb57a588463f457

Bug: 22414321

Change-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc
related-to-bug: 18394494
related-to-bug: 19664283
(cherry picked from commit 2fb561a6)

This reverts commit d3831760.

Change-Id: I0509f7eadb3a27c4cadbd3088cb57a588463f457

Various software video decoders would specify the buffer size as if it were
fully cropped, which then failed a sanity check in SoftwareRenderer.
They now return the full buffer size.

Bug: 21717327
Bug: 21443020
Change-Id: I19fcd091827ebd52a95a5509281a07ccc156e0e5
(cherry picked from commit 3ecc9db4)

Bug: 20674086
Change-Id: Ie2c711865c3b92f3fa2f3c7a436fa0e3687eb8b3
(cherry picked from commit d7bb1cd7)

This reverts commit c23e3dd8.

This speculative fix didn't fix the compile failure, do checking locally.

Change-Id: I1598f7208c8232ca38c0fcad17f211598591594e

Bug: 20674086
Change-Id: I431aa2b7d30a942350ab6d105451c6b77e2f99d4
(cherry picked from commit 42cccd7c)

Bug: 22414321

Change-Id: I062c662a440a1becccd248c3b8ddf711c51e53cc
related-to-bug: 18394494
related-to-bug: 19664283
(cherry picked from commit 2fb561a6)

Bug: 21443020
Change-Id: I63cf86217b8201fb41809c23e4b752b845a93ee2
(cherry picked from commit 760f92f8)

Bug: 23416608
Change-Id: I4dacd38ed42db8f4887c3ee386dc909451f4346f

Integer overflows could occur a few places within findFrame. These can lead to
out-of-bounds reads and potentially infinite loops. Ensure that arithmetic does
not wrap around to prevent these behaviors.

Bug: 23285192
Change-Id: I72a61df7d5719d1d3f2bd0b37fba86f0f4bbedee

Clarify that decrypt destination is not a pointer for
secure case.

b/23223325

Change-Id: I642dcf790a9eb9e32175f3e0d8f040c82228e3ac
(cherry picked from commit ed555d70)

Bug: 23270724
Change-Id: Id7ba55c7bf6860fbfc892bbb6378aac644c82da4
(cherry picked from commit c51ab7dd)

Bug: 23346388
Change-Id: Ifd918cefc90527c2f52177c3ce0da7a13259ad08

- The ABuffer used for the Message has a preset value of 1024, if
  flattening the meta data exceeds this value, a check fails hence
  the crash.
- This change creates a new ABuffer if the buffer size would exceed
  the buffer capacity.

Bug: 22771132

CRs-Fixed: 857850

(cherry picked from commit 9c170c07)

Change-Id: I056ade2f95bc8d82dfe092de7ecddba588cc5b72

Bug: 23247055
Change-Id: I29ef59c7ff09248063714e5013f7c33f66c5eebd
(cherry picked from commit 3564c456)
(cherry picked from commit 108cd2dc)

Clear output stream pointer in duplicating thread
when the main output to which it is attached is closed.

Also do not forward master mute and volume commands to
duplicating threads as this is not applicable.

Also fix logic in AudioFlinger::primaryPlaybackThread_l()
that could accidentally return a duplicating thread.
This never happens because the primary thread is always
first in the list.

Bug: 20731946.
Change-Id: Ic8869699836920351b23d09544c50a258d3fb585
(cherry picked from commit f6870aef)

Bug: 23306638
Change-Id: I2b5160e0f58f90d3f67c3964f41f5734ec0da053

Bug: 20674674
Change-Id: I511c22d59789e1cc3a21fe13ea08ac3752e737c6

Bug: 21335999
Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4
(cherry picked from commit 2dcf6138)

Bug: 23227354

Change-Id: Iaa36cfda4fd84ca7e039f56086fd61b4118020db
(cherry picked from commit 77e23413)

Bug: 20674674
Change-Id: Iace5b8c882339b3a9d2e706375255aeeeb0532fe