Merge "cas: validate shared buffer size before using" into oc-mr1-dev
diff --git a/current.txt b/current.txt
index db34c37..d4f20d3 100644
--- a/current.txt
+++ b/current.txt
@@ -193,6 +193,7 @@
 150a338ce11fcec70757c9675d83cf6a5d7b40d0c812741b91671fecce59eac9 android.hardware.broadcastradio@1.0::types
 dc7e6d4f537b9943e27edc4f86c5a03bb643b18f18f866f8c3c71c0ac4ea8cbc android.hardware.broadcastradio@1.0::types
 760485232f6cce07f8bb05e3475509956996b702f77415ee5bff05e2ec5a5bcc android.hardware.dumpstate@1.0::IDumpstateDevice
+78589343d8ee2e1b155acad3fbdc7fcbb6af94491aee968b2383c21627264f8b android.hardware.radio@1.0::IRadioResponse # Available in Android O, b/68061860
 e822cb7f4a1bdd45689c5e92ccd19a2201c20b771bd4b2ec1ae627e324591f9d android.hardware.radio@1.0::IRadioResponse
 6e69adb24d7c0b0ca3a54a38c49a5625b161b3f5d5f7d6fda0befdbbfc8e9e06 android.hardware.radio@1.0::IRadioResponse
 28e929b453df3d9f5060af2764e6cdb123ddb893e3e86923c877f6ff7e5f02c9 android.hardware.wifi@1.0::types
diff --git a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
index 4652c76..a110eb1 100644
--- a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
@@ -89,6 +89,10 @@
     0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x80,
     0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x80};
 
+static const uint32_t k256SubSampleByteCount = 256;
+static const uint32_t k512SubSampleClearBytes = 512;
+static const uint32_t k512SubSampleEncryptedBytes = 512;
+
 class DrmHalClearkeyFactoryTest : public ::testing::VtsHalHidlTargetTestBase {
    public:
     virtual void SetUp() override {
@@ -965,6 +969,8 @@
             const hidl_vec<SubSample>& subSamples, const vector<uint8_t>& key);
     void aes_cbc_decrypt(uint8_t* dest, uint8_t* src, uint8_t* iv,
             const hidl_vec<SubSample>& subSamples, const vector<uint8_t>& key);
+    void decryptWithInvalidKeys(hidl_vec<uint8_t>& invalidResponse,
+            vector<uint8_t>& iv, const Pattern& noPattern, const vector<SubSample>& subSamples);
 };
 
 void DrmHalClearkeyDecryptTest::fillRandom(const sp<IMemory>& memory) {
@@ -1119,16 +1125,14 @@
     closeSession(sessionId);
 }
 
-
 /**
  * Positive decrypt test.  "Decrypt" a single clear segment
  */
 TEST_F(DrmHalClearkeyDecryptTest, ClearSegmentTest) {
     vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
     const Pattern noPattern = {0, 0};
-    const uint32_t kByteCount = 256;
     const vector<SubSample> subSamples = {
-        {.numBytesOfClearData = kByteCount,
+        {.numBytesOfClearData = k256SubSampleByteCount,
          .numBytesOfEncryptedData = 0}};
     auto sessionId = openSession();
     loadKeys(sessionId);
@@ -1138,7 +1142,7 @@
 
     uint32_t byteCount = decrypt(Mode::UNENCRYPTED, &iv[0], subSamples,
             noPattern, Status::OK);
-    EXPECT_EQ(kByteCount, byteCount);
+    EXPECT_EQ(k256SubSampleByteCount, byteCount);
 
     closeSession(sessionId);
 }
@@ -1150,12 +1154,9 @@
 TEST_F(DrmHalClearkeyDecryptTest, EncryptedAesCtrSegmentTest) {
     vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
     const Pattern noPattern = {0, 0};
-    const uint32_t kClearBytes = 512;
-    const uint32_t kEncryptedBytes = 512;
     const vector<SubSample> subSamples = {
-        {.numBytesOfClearData = kClearBytes,
-         .numBytesOfEncryptedData = kEncryptedBytes
-        }};
+        {.numBytesOfClearData = k512SubSampleClearBytes,
+         .numBytesOfEncryptedData = k512SubSampleEncryptedBytes}};
     auto sessionId = openSession();
     loadKeys(sessionId);
 
@@ -1164,10 +1165,11 @@
 
     uint32_t byteCount = decrypt(Mode::AES_CTR, &iv[0], subSamples,
             noPattern, Status::OK);
-    EXPECT_EQ(kClearBytes + kEncryptedBytes, byteCount);
+    EXPECT_EQ(k512SubSampleClearBytes + k512SubSampleEncryptedBytes, byteCount);
 
     closeSession(sessionId);
 }
+
 /**
  * Negative decrypt test. Decrypt without loading keys.
  */
@@ -1175,8 +1177,8 @@
     vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
     const Pattern noPattern = {0, 0};
     const vector<SubSample> subSamples = {
-        {.numBytesOfClearData = 256,
-         .numBytesOfEncryptedData = 256}};
+        {.numBytesOfClearData = k256SubSampleByteCount,
+         .numBytesOfEncryptedData = k256SubSampleByteCount}};
     auto sessionId = openSession();
 
     Status status = cryptoPlugin->setMediaDrmSession(sessionId);
@@ -1188,3 +1190,94 @@
 
     closeSession(sessionId);
 }
+
+/**
+ * Helper method to test decryption with invalid keys is returned
+ */
+void DrmHalClearkeyDecryptTest::decryptWithInvalidKeys(
+        hidl_vec<uint8_t>& invalidResponse,
+        vector<uint8_t>& iv,
+        const Pattern& noPattern,
+        const vector<SubSample>& subSamples) {
+    auto sessionId = openSession();
+
+    auto res = drmPlugin->provideKeyResponse(
+        sessionId, invalidResponse,
+        [&](Status status, const hidl_vec<uint8_t>& myKeySetId) {
+            EXPECT_EQ(Status::OK, status);
+            EXPECT_EQ(0u, myKeySetId.size());
+        });
+    ASSERT_OK(res);
+
+    ASSERT_TRUE(cryptoPlugin->setMediaDrmSession(sessionId).isOk());
+
+    uint32_t byteCount = decrypt(Mode::AES_CTR, &iv[0], subSamples,
+            noPattern, Status::ERROR_DRM_NO_LICENSE);
+    EXPECT_EQ(0u, byteCount);
+
+    closeSession(sessionId);
+}
+
+/**
+ * Negative decrypt test. Decrypt with invalid key.
+ */
+TEST_F(DrmHalClearkeyDecryptTest, DecryptWithEmptyKey) {
+    vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+    const Pattern noPattern = {0, 0};
+    const vector<SubSample> subSamples = {
+        {.numBytesOfClearData = k512SubSampleClearBytes,
+         .numBytesOfEncryptedData = k512SubSampleEncryptedBytes}};
+
+    // base 64 encoded JSON response string, must not contain padding character '='
+    const hidl_string emptyKeyResponse =
+            "{\"keys\":[" \
+                "{" \
+                    "\"kty\":\"oct\"" \
+                    "\"alg\":\"A128KW2\"" \
+                    "\"k\":\"SGVsbG8gRnJpZW5kIQ\"" \
+                    "\"kid\":\"Y2xlYXJrZXlrZXlpZDAyAy\"" \
+                "}" \
+                "{" \
+                    "\"kty\":\"oct\"," \
+                    "\"alg\":\"A128KW2\"" \
+                    "\"kid\":\"Y2xlYXJrZXlrZXlpZDAzAy\"," \
+                    // empty key follows
+                    "\"k\":\"R\"" \
+                "}]" \
+            "}";
+    const size_t kEmptyKeyResponseSize = emptyKeyResponse.size();
+
+    hidl_vec<uint8_t> invalidResponse;
+    invalidResponse.resize(kEmptyKeyResponseSize);
+    memcpy(invalidResponse.data(), emptyKeyResponse.c_str(), kEmptyKeyResponseSize);
+    decryptWithInvalidKeys(invalidResponse, iv, noPattern, subSamples);
+}
+
+/**
+ * Negative decrypt test. Decrypt with a key exceeds AES_BLOCK_SIZE.
+ */
+TEST_F(DrmHalClearkeyDecryptTest, DecryptWithKeyTooLong) {
+    vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+    const Pattern noPattern = {0, 0};
+    const vector<SubSample> subSamples = {
+        {.numBytesOfClearData = k512SubSampleClearBytes,
+         .numBytesOfEncryptedData = k512SubSampleEncryptedBytes}};
+
+    // base 64 encoded JSON response string, must not contain padding character '='
+    const hidl_string keyTooLongResponse =
+            "{\"keys\":[" \
+                "{" \
+                    "\"kty\":\"oct\"," \
+                    "\"alg\":\"A128KW2\"" \
+                    "\"kid\":\"Y2xlYXJrZXlrZXlpZDAzAy\"," \
+                    // key too long
+                    "\"k\":\"V2lubmllIHRoZSBwb29oIVdpbm5pZSB0aGUgcG9vaCE=\"" \
+                "}]" \
+            "}";
+    const size_t kKeyTooLongResponseSize = keyTooLongResponse.size();
+
+    hidl_vec<uint8_t> invalidResponse;
+    invalidResponse.resize(kKeyTooLongResponseSize);
+    memcpy(invalidResponse.data(), keyTooLongResponse.c_str(), kKeyTooLongResponseSize);
+    decryptWithInvalidKeys(invalidResponse, iv, noPattern, subSamples);
+}
diff --git a/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp b/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
index d572728..d2fa92d 100644
--- a/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
+++ b/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
@@ -26,6 +26,7 @@
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netlink.h>
 #include <log/log.h>
+#include <net/if.h>
 #include <sys/socket.h>
 #include <unistd.h>
 #include <set>
@@ -52,6 +53,8 @@
     True = 1,
 };
 
+constexpr const char* TEST_IFACE = "rmnet_data0";
+
 // We use #defines here so as to get local lamba captures and error message line numbers
 #define ASSERT_TRUE_CALLBACK                            \
     [&](bool success, std::string errMsg) {             \
@@ -240,6 +243,18 @@
     stopOffload(ExpectBoolean::False);
 }
 
+// Check whether the specified interface is up.
+bool interfaceIsUp(const char* name) {
+    if (name == nullptr) return false;
+    struct ifreq ifr = {};
+    strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
+    int sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    if (sock == -1) return false;
+    int ret = ioctl(sock, SIOCGIFFLAGS, &ifr, sizeof(ifr));
+    close(sock);
+    return (ret == 0) && (ifr.ifr_flags & IFF_UP);
+}
+
 // Check that calling stopOffload() after a complete init/stop cycle returns false.
 TEST_F(OffloadControlHidlTestBase, AdditionalStopsWithInitReturnFalse) {
     initOffload(true);
@@ -249,8 +264,11 @@
     const hidl_string v4Gw("192.0.0.1");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1"), hidl_string("fe80::db8:2")};
     const Return<void> upstream =
-        control->setUpstreamParameters("rmnet_data0", v4Addr, v4Gw, v6Gws, ASSERT_TRUE_CALLBACK);
+        control->setUpstreamParameters(TEST_IFACE, v4Addr, v4Gw, v6Gws, ASSERT_TRUE_CALLBACK);
     EXPECT_TRUE(upstream.isOk());
+    if (!interfaceIsUp(TEST_IFACE)) {
+        return;
+    }
     stopOffload(ExpectBoolean::True);  // balance out initOffload(true)
     stopOffload(ExpectBoolean::False);
     stopOffload(ExpectBoolean::False);
@@ -266,14 +284,14 @@
 // Check that calling getForwardedStats() without first having called initOffload()
 // returns zero bytes statistics.
 TEST_F(OffloadControlHidlTestBase, GetForwardedStatsWithoutInitReturnsZeroValues) {
-    const hidl_string upstream("rmnet_data0");
+    const hidl_string upstream(TEST_IFACE);
     const Return<void> ret = control->getForwardedStats(upstream, ASSERT_ZERO_BYTES_CALLBACK);
     EXPECT_TRUE(ret.isOk());
 }
 
 // Check that calling setDataLimit() without first having called initOffload() returns false.
 TEST_F(OffloadControlHidlTestBase, SetDataLimitWithoutInitReturnsFalse) {
-    const hidl_string upstream("rmnet_data0");
+    const hidl_string upstream(TEST_IFACE);
     const uint64_t limit = 5000ULL;
     const Return<void> ret = control->setDataLimit(upstream, limit, ASSERT_FALSE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -282,7 +300,7 @@
 // Check that calling setUpstreamParameters() without first having called initOffload()
 // returns false.
 TEST_F(OffloadControlHidlTestBase, SetUpstreamParametersWithoutInitReturnsFalse) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("192.0.2.0/24");
     const hidl_string v4Gw("192.0.2.1");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1")};
@@ -294,7 +312,7 @@
 // Check that calling addDownstream() with an IPv4 prefix without first having called
 // initOffload() returns false.
 TEST_F(OffloadControlHidlTestBase, AddIPv4DownstreamWithoutInitReturnsFalse) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string prefix("192.0.2.0/24");
     const Return<void> ret = control->addDownstream(iface, prefix, ASSERT_FALSE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -303,7 +321,7 @@
 // Check that calling addDownstream() with an IPv6 prefix without first having called
 // initOffload() returns false.
 TEST_F(OffloadControlHidlTestBase, AddIPv6DownstreamWithoutInitReturnsFalse) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string prefix("2001:db8::/64");
     const Return<void> ret = control->addDownstream(iface, prefix, ASSERT_FALSE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -312,7 +330,7 @@
 // Check that calling removeDownstream() with an IPv4 prefix without first having called
 // initOffload() returns false.
 TEST_F(OffloadControlHidlTestBase, RemoveIPv4DownstreamWithoutInitReturnsFalse) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string prefix("192.0.2.0/24");
     const Return<void> ret = control->removeDownstream(iface, prefix, ASSERT_FALSE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -321,7 +339,7 @@
 // Check that calling removeDownstream() with an IPv6 prefix without first having called
 // initOffload() returns false.
 TEST_F(OffloadControlHidlTestBase, RemoveIPv6DownstreamWithoutInitReturnsFalse) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string prefix("2001:db8::/64");
     const Return<void> ret = control->removeDownstream(iface, prefix, ASSERT_FALSE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -394,10 +412,10 @@
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, GetForwardedStatsDummyIface) {
-    const hidl_string upstream("rmnet_data0");
+    const hidl_string upstream(TEST_IFACE);
     const Return<void> ret = control->getForwardedStats(upstream, ASSERT_ZERO_BYTES_CALLBACK);
     EXPECT_TRUE(ret.isOk());
 }
@@ -414,19 +432,19 @@
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetDataLimitNonZeroOk) {
-    const hidl_string upstream("rmnet_data0");
+    const hidl_string upstream(TEST_IFACE);
     const uint64_t limit = 5000ULL;
     const Return<void> ret = control->setDataLimit(upstream, limit, ASSERT_TRUE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetDataLimitZeroOk) {
-    const hidl_string upstream("rmnet_data0");
+    const hidl_string upstream(TEST_IFACE);
     const uint64_t limit = 0ULL;
     const Return<void> ret = control->setDataLimit(upstream, limit, ASSERT_TRUE_CALLBACK);
     EXPECT_TRUE(ret.isOk());
@@ -436,10 +454,10 @@
  * Tests for IOffloadControl::setUpstreamParameters().
  */
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersIPv6OnlyOk) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("");
     const hidl_string v4Gw("");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1"), hidl_string("fe80::db8:2")};
@@ -448,10 +466,10 @@
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersAlternateIPv6OnlyOk) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr;
     const hidl_string v4Gw;
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1"), hidl_string("fe80::db8:3")};
@@ -460,10 +478,10 @@
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersIPv4OnlyOk) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("192.0.2.2");
     const hidl_string v4Gw("192.0.2.1");
     const vector<hidl_string> v6Gws{};
@@ -472,10 +490,10 @@
     EXPECT_TRUE(ret.isOk());
 }
 
-// The "rmnet_data0" is presumed to exist on the device and be up. No packets
+// TEST_IFACE is presumed to exist on the device and be up. No packets
 // are ever actually caused to be forwarded.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersIPv4v6Ok) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("192.0.2.2");
     const hidl_string v4Gw("192.0.2.1");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1"), hidl_string("fe80::db8:2")};
@@ -511,7 +529,7 @@
 
 // Test that setUpstreamParameters() fails when given unparseable IPv4 addresses.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersInvalidIPv4AddrFails) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Gw("192.0.2.1");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1")};
     for (const auto& bogus : {"invalid", "192.0.2"}) {
@@ -525,7 +543,7 @@
 
 // Test that setUpstreamParameters() fails when given unparseable IPv4 gateways.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersInvalidIPv4GatewayFails) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("192.0.2.2");
     const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1")};
     for (const auto& bogus : {"invalid", "192.0.2"}) {
@@ -539,7 +557,7 @@
 
 // Test that setUpstreamParameters() fails when given unparseable IPv6 gateways.
 TEST_F(OffloadControlHidlTest, SetUpstreamParametersBadIPv6GatewaysFail) {
-    const hidl_string iface("rmnet_data0");
+    const hidl_string iface(TEST_IFACE);
     const hidl_string v4Addr("192.0.2.2");
     const hidl_string v4Gw("192.0.2.1");
     for (const auto& bogus : {"", "invalid", "fe80::bogus", "192.0.2.66"}) {