Bug: 142252770
Bug: 169137236
Bug: 169139756
Test: this
Features built into the PNG format slow down fuzzing (e.g. CRC, encoded
lengths) [1]. Use structure aware fuzzing for PNG to do a better search
through the input space. Add png_mutator.h (unchanged from [2] under the
Apache 2.0 license). Split imagedecoder_fuzzer into two targets: one for
PNGs (since the mutator converts all inputs into PNG), and one for the
other formats.
Move fuzz_imagedecoder.cpp and the corpus/ into the new fuzz/ directory,
to keep fuzzing separate from the libjnigraphics library. Remove
png_test.png from the corpus; structure aware fuzzing will do a better
job of fuzzing PNGs, and the generic one should focus on other formats.
[1] https://github.com/google/fuzzing/blob/master/docs/structure-aware-fuzzing.md
[2] 51356066dc/libpng-1.2.56/png_mutator.h (L1)
Change-Id: I8aebb0d0abfa18793334f2d217b28a51d096123a
Test: I138ec784a77253c7ae94765d0670e5947d97caf5
Recently (Ib93b0ced09fa3cca4a6681745406355c48158fae), handling exif
moved from SkAndroidCodec to hwui/ImageDecoder. This missed
getSampledDimensions, which reports the sampled dimensions without
taking exif into account. Fix this for both
android.graphics.ImageDecoder and AImageDecoder. Note that in the Java
case, the method is private, and although the method was returning
swapped dimensions in some cases, it gets corrected by
getTargetDimension, so there is no user visible change.
Change-Id: I918328c39d6230ae6ba4cab0733fff0732b39888
__ANDROID_API__ guards are removed in favor of __INTRODUCED_IN macros.
Currently, __INTRODUCED_IN macro does nothing for these headers (it's
meaningful only to the headers processed by versioner which are limited
to binic headers). The plan is to make the macros to tag the declaration
with the availability attribute. Then, when the min_sdk_version of a
caller is set to an API level that is older than the API level of the
APIs, the compiler will provide them as weak symbols and enforce that
calling the APIs are guarded with a runtime check.
For now, these guards are preventing from making a build system change
to let __ANDROID_API__ track the min_sdk_version property instead of the
sdk_version property. With the build system change, __ANDROID_API__ will
suddenly drop for the native modules where min_sdk_version <
sdk_version, which is the case when the modules are included in APEXes.
As a result, some new APIs will be unavailable at build-time. Dropping
the hand-written guards fixes the problem.
Bug: 163288375
Test: m
Change-Id: I8cafdba77fe358b2dcc9ad33f43c5410c9c27934
Bug: 142252770
Bug: 169137236
Bug: 169139756
Test: this
Image decoders may attempt to allocate a large amount of memory
(especially if the encoded image is large). This doesn't necessarily
mean there is a bug. Set allocator_may_return_null = 1 for hwasan so the
fuzzer can continue running.
Change-Id: Ib750a142e28d01144036409786e631dfb783283f
Bug: 142252770
Bug: 169137236
Bug: 169139756
Test: SANITIZE_HOST=address make imagedecoder_fuzzer
This will allow running the fuzzer much faster in order to find bugs. It
also allows running with ASAN to help find memory leaks.
Some symbols (e.g. ABitmap, AAssetStreamAdaptor) rely on
Android-specific features, so disable them when building on the host.
This still allows using the core features of AImageDecoder.
This requires a change in frameworks/native
(Iefdb4132d6f10f9164be85f4dc6e11883f6fd37e).
Disable detecting ODR violations when building with ASAN (which is how
host builds are built). Without this change, the host detects the
following:
=================================================================
==4072183==ERROR: AddressSanitizer: odr-violation (0x7fb7d52b4100):
[1] size=80 'vtable for android::VectorImpl' system/core/libutils/VectorImpl.cpp
[2] size=80 'vtable for android::VectorImpl' system/core/libutils/VectorImpl.cpp
These globals were registered at these points:
[1]:
#0 0x55fefda47e0d in __asan_register_globals /out/llvm-project/compiler-rt/lib/asan/asan_globals.cpp:360:3
#1 0x7fb7d43aa77b in asan.module_ctor (/usr/local/ssd/android/master/out/host/linux-x86/fuzz/x86_64/imagedecoder_fuzzer/../lib/libhw
ui.so+0x17c677b)
[2]:
#0 0x55fefda47e0d in __asan_register_globals /out/llvm-project/compiler-rt/lib/asan/asan_globals.cpp:360:3
#1 0x7fb7d52a0e6b in asan.module_ctor (/usr/local/ssd/android/master/out/host/linux-x86/fuzz/x86_64/imagedecoder_fuzzer/../lib/libutils.so+0x3de6b)
==4072183==HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_odr_violation=0
SUMMARY: AddressSanitizer: odr-violation: global 'vtable for android::VectorImpl' at system/core/libutils/VectorImpl.cpp
==4072183==ABORTING
Change-Id: I0ffc4e90b4083db79fbb12012e2e1284206b43e3
Bug: 169137236
Bug: 169139756
Test: this (fuzzer)
Extend the fuzzer to test animations.
Also test a lossless webp, left out of
Ib227639bf8da75f0e8e31e216bc6d1371e24cb75.
Change-Id: I81d35d6fa7d560b33b6a2b5d6c1992cbdd77bc87
Bug: 142252770
Bug: 169137236
Bug: 169139756
Test: This (fuzzer)
Attempt to cover the types supported by AImageDecoder:
- jpeg (progressive and baseline)
- png
- webp (animated and non-animated)
- should maybe include lossless, too?
- gif
- ico (embedded png and bmp)
- bmp
- wbmp
- heif
- various dng formats
These files are either already checked into CTS or Skia.
Change-Id: Ib227639bf8da75f0e8e31e216bc6d1371e24cb75
Bug: 142252770
Bug: 169137236
Bug: 169139756
Test: This (fuzzer)
Use the bytes to create an image file and decode it.
To run:
$ SANITIZE_TARGET=hwaddress make imagedecoder_fuzzer
$ adb root
$ adb sync data
$ adb shell /data/fuzz/arm64/imagedecoder_fuzzer/imagedecoder_fuzzer
Call startThreadPool() to support HEIF. Otherwise HEIF decodes may time
out on binder IPC calls. This is similar to a fix for skia_dm in
https://skia-review.googlesource.com/c/skia/+/108141.
Change-Id: I434730a74c5ff97437526065c41af3f54fae3335
Bug: 160984428
Test: I00682f201a52f894b0e1335c00c4368ce675a805
Also fix a bug caught by the new test. If the current frame is the first
in a series of one or more RestorePrevious frames, fPriorFrame should be
set to |currentFrame - 1|. Otherwise SkCodec will decode the required
frame. This is wasted work, since the prior frame should already be
prepared (either by AImageDecoder or by the client).
Change-Id: I1fb9f91dc66fd3121f187b9a91c15f625eb17f8d
Bug: 160984428
Test: If47d475233f6b9973abf68029b63a610ff47cdae
- AImageDecoder_getFrameInfo
- AImageDecoderFrameInfo_create
- AImageDecoderFrameInfo_delete
- AImageDecoderFrameInfo_getDuration
- AImageDecoderFrameInfo_getFrameRect
- AImageDecoderFrameInfo_getDisposeOp
- AImageDecoderFrameInfo_getBlendOp
- AImageDecoderFrameInfo_hasAlphaWithinBounds
These allow querying for information specific to a single frame in an
encoded image.
Change-Id: I6ce5665e9c25aed23f99ce88290e520d68fcb60e
core/java/android/graphics doesn't exist, so neither
does core/android/graphics/OWNERS
Fix the include path to point to the graphics source of truth
as /graphics/java/android/graphics/OWNERS
Test: this
Change-Id: I5a1e6edbc82df5e3b2979753a6d7329707c55d88
Bug: 160984428
Test: AImageDecoderTest#testRespectOrientation
ImageDecoderTest#testRespectOrientation
Ieda439910ae52e609f0710d424503616d99ae5c7
I23caef26b4c82173c758dd0ce7fb6f04e4154588
I345a13d20776a007052d32e74fa42865b42f726d
It is possible to create an animated image with an exif orientation.
Using kRespect, there is no clean way to handle the orientation plus
compositing frames. Switch ImageDecoder to use kIgnore (the default).
Depends on a change in Skia (https://review.skia.org/344762) to make
SkAnimatedImage handle the orientation even with kIgnore.
Change-Id: Ib93b0ced09fa3cca4a6681745406355c48158fae
Bug: 160984428
Test: Iae7d274b69999c471fd5610c6ef4d148cca81bec
Disallow AImageDecoder_set* methods after the first frame, since
changing the settings would interfere with blending and caching for
kRestorePrevious frames.
Add a cache (and a state machine) for handling kRestorePrevious frames.
Follow-on to Ib93b0ced09fa3cca4a6681745406355c48158fae - support using
a matrix for unpremul + orientation (the orientation was previously
handled by a matrix internally in SkAndroidCodec).
Change-Id: I7c32ede013fa83f1fe95c35778c33278ca6fe6a3
Bug: 174932174
Test: I solemnly swear I tested this conflict resolution.
Exempt-From-Owner-Approval: refactoring with team leads buy-in
Change-Id: I9262a08ffc1ccede8e519d0eed90ed2bfcf0232c
As general background, OWNERS files expedite code reviews by helping
code authors quickly find relevant reviewers, and they also ensure
that stakeholders are involved in code changes in their areas.
Some teams under frameworks/base/ have been using OWNERS files
successfully for many years, and we're ready to expand them to cover
more areas. Here's the historical coverage statistics for the last
two years of changes before these new OWNERS changes land:
-- 56% of changes are fully covered by OWNERS
-- 17% of changes are partially covered by OWNERS
-- 25% of changes have no OWNERS coverage
Working closely with team leads, we've now identified clear OWNERS on
a per-package basis, and we're using "include" directives whenever
possible to to simplify future maintenance. With this extensive
effort, we've now improved our coverage as follows:
-- 98% of changes are fully covered by OWNERS
-- 1% of changes are partially covered by OWNERS
-- 1% of changes have no OWNERS coverage
This specific change is automatically generated by a script that
identifies relevant "include" directives.
Bug: 174932174
Test: manual
Exempt-From-Owner-Approval: refactoring with team leads buy-in
Merged-In: I3480ddf2fe7ba3dfb922b459d4da01fa17a2c813
Change-Id: I3480ddf2fe7ba3dfb922b459d4da01fa17a2c813
Add a gtest that runs as root to test receving UidImportance
updates.
bug: 172942349
bug: 159172726
Change-Id: I2c6ee84f09afd1638c53e502e288f23bd8717a9b
This CL adds api that exposes SurfaceControl to allow webview to
submit ASurfaceTransaction synchronously with hwui draw.
Test: just new API stubs, nothing to test.
Change-Id: I3a70ad12d04e5a1655887faf3782426a9131a999
Add UidImportanceListener methods to libandroid for native apex use.
bug: 172942349
bug: 159172726
bug: 146507383
test: updated mediatranscoding's UidPolicy locally to use the new api,
and passed mediatranscodingservice unit tests.
Change-Id: I7ca76f057a83b5bcd634deb2408784d7b93e46fc
This CL adds a new parameter shouldBeSeamless to the existing
setFrameRate APIs. This parameter indicates whether the desired
refresh rate should be achieved only seamlessly or also switches
with visual interruptions for the user are allowed. The default
value of the new parameter is "true".
Test: atest SetFrameRateTest
Test: atest RefreshRateConfigsTest
Test: atest libsurfaceflinger_unittest
Bug: 161776961
Change-Id: Ic2446d278e4f57fe507d30a0a18ef7b85909da4b
And allow IActivityManager#checkPermission to be used by native code.
bug: 172283477
bug: 159172726
Change-Id: I582fb918ac3ddc2289ef0040a4391db407673692
App such as Chrome create child surfaces and parent them to
surfaces provided by SurfaceView. When we enable the blast
adapter for SurfaceView, the IGBP returned to the app is
created in the client and SurfaceFlinger does not know about it.
When the app creates a child surface and provides the IGBP as the
parent surface identifier, SF fails to validate the IGBP and the
surface is not created. This can be avoid if the client creates the
child surface from the SV SurfaceControl but we still need to
support existing APIs.
To fix this, when we create a Surface from the adapter, pass in
the handle of the Blast SurfaceControl. When calling
ASurfaceControl_createFromWindow, use this handle to identify
the parent.
Bug: 168917217
Test: adb shell settings put global use_blast_adapter_sv 1 & launch chrome
Change-Id: I879b411c47e8558397516bd7b7278813e79e005f
Instead of assuming a module with the .llndk suffix exists, add an
llndk_stubs property to every cc_library module that has a
corresponding llndk_library. Also rename the llndk_library to have
an explicit .llndk suffix.
Bug: 170784825
Test: no changes to build.ninja (excluding comments) or Android-${TARGET_PRODUCT}.mk
Change-Id: I5f0b9d92162b532b1e6e8752ac3e130759cde08c
