===================================
Since Sun Jul 31 13:15:42 UTC 2016
===================================

   * build
5bfbc0d Update security patch string to 2016-08-01 - For Partners only

   * external/bluetooth/bluedroid
9038d51 DO NOT MERGE Fix potential DoS caused by delivering signal to BT process

   * external/flac
6e50dc9 Remove by accident added patchfile

   * external/jhead
fcbff49 Fix possible out of bounds access

   * external/openssl
8089c4a Fix memory issues in BIO_*printf functions

   * frameworks/av
1bc335e DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak
c44a658 DO NOT MERGE omx: check buffer port before using
769ac47 Check effect command reply size in AudioFlinger
808e27b DO NOT MERGE SoftAAC2: fix crash on all-zero adts buffer
3d3cbe4 Fix potential overflow
0b36647 Don't use sp<>&
0ceff87 DO NOT MERGE MPEG4Extractor: ensure kKeyTrackID exists before creating an MPEG4Source as track.
4fbec7e DO NOT MERGE Check malloc result to avoid NPD
69c54bf DO NOT MERGE limit mediaserver memory

   * frameworks/base
add6f6b DO NOT MERGE: Don't trust callers to supply app info to bindBackupAgent()

   * frameworks/opt/telephony
885d3b2 backport security fix: avoid set NITZ time to 2038

   * hardware/qcom/media
71af4df DO NOT MERGE mm-video-v4l2: venc: add checks before accessing heap pointers

   * libcore
3f575a6 Use SSL_session_reused to check when a session was reused

===================================
Since Sun Jul  3 18:39:04 UTC 2016
===================================

   * bionic
3476717 Fix overflow testing in sbrk.
f9134dc Fix brk/sbrk error checking.

   * bootable/recovery
a8cf70c Remove mistakenly added bulletin patch

   * build
ae837b3 core: support make 4.00
af532ea Revert "Support building with GNU make 4.0"
e175a30 Updating security string to 2016-07-01

   * dalvik
066a714 Fix potential buffer overrun.

   * external/bluetooth/bluedroid
dac08b9 DO NOT MERGE btif: check overflow on create_pbuf size

   * external/openssl
0b9cc2d Check that we have enough padding characters.
dac9f01 Constant-time utilities
52912e9 Fix encoding bug in i2c_ASN1_INTEGER

   * external/skia
4447168 Use min/max to pin value between 0 and 255.

   * external/tremolo
55ac491 Check partword is in range for # of partitions

   * frameworks/av
8ee980e h264bsdActivateParamSets: Prevent multiplication overflow.
0b9ec53 Fix security vulnerability in libstagefright
168fac6 Clear unused pointer field when sending across binder

   * frameworks/base
c6ac7f7 Don't pass URL path and username/password to PAC scripts

   * frameworks/native
91a4e5a Correctly handle dup() failure in Parcel::readNativeHandle

   * hardware/qcom/audio
29b43a5 DO NOT MERGE Fix AudioEffect reply overflow

   * hardware/qcom/media
219a1e9 DO NOT MERGE mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states
139f775 DO NOT MERGE mm-video-v4l2: vdec: Avoid processing ETBs/FTBs in invalid states

   * packages/apps/Nfc
3cf88c5 Verify setForegroundDispatch caller is in foreground. (DO NOT MERGE)

   * system/core
bf702fd Fix scanf %s in lsof.

===================================
Since Sun Nov  8 03:31:59 UTC 2015
===================================

   * android
d8cb7eb Revert "Deprecate CMAccount"
178166c Deprecate CMAccount
2d8e600 manifest: Remove whispersystems (EOL Feb 1)

   * bootable/recovery
90afeeb Track usage of Vector / SortedVector from libutils DO NOT MERGE

   * bootable/recovery-cm
f34be06 Track usage of Vector / SortedVector from libutils DO NOT MERGE

   * build
c0f55bf Update security patch string to 2016-06-01
4103328 Merge Conflict--Update Security String to 2016-05-01 in preparation for May 2016 Security OTA
83df17d Updating security string patch to 2016-04-01
06ea5b1 Updating security patch string to 2016-03-01
d7c10fb DO NOT MERGE - Update security string to 2016-02-01
040dbab Update Security String to 2016-01-01 - DO NOT MERGE
602b987 Update security string to 2015-12-01 - DO NOT MERGE
63c4e1f DO NOT MERGE - Backport of ag/748221 - Security Patch Level in Settings CL#2/3

   * device/xiaomi/aries
1e8355c Fix charger include of libutils

   * external/aac
faadf2b Fix aacDecoder_drcExtractAndMap()
7cc9e58 Fix stack corruption happening in aacDecoder_drcExtractAndMap()

   * external/bluetooth/bluedroid
fa4a9aa DO NOT MERGE Check size of pin before replying
82cfb82 DO NOT MERGE Remove Porsche car-kit pairing workaround
9187e00 DO NOT MERGE - Add proper checks for PAN & BNEP in BD stack

   * external/bouncycastle
74e3da7 DO NOT MERGE bouncycastle: limit input length as specified by the NIST spec

   * external/dhcpcd
6166cab Improve length checks in DHCP Options parsing of dhcpcd.
787c162 Really disable IPv6 RA processing in dhcpcd.
be381d3 Fix DoS vulnerability in DHO_OPTIONSOVERLOADED.

   * external/flac
9fd8181 Avoid free-before-initialize vulnerability in heap

   * external/libvpx
a922ee9 DO NOT MERGE - external/libvpx/libwebm: Update snapshot
9e82692 DO NOT MERGE - libvpx: Pull from upstream

   * external/openssl
0e5fc0b Fix double-free in DSA code (CVE-2016-0705)

   * external/skia
599fc00 Update SK_CRASH to default to abort().
93b1665 Fix removal of SI8_opaque_D32_nofilter_DX_arm
4d85ee6 Remove SI8_opaque_D32_nofilter_DX_arm DO NOT MERGE
b95b5cc SkScaledBitmapSampler: fix memory overwritten

   * external/sonivox
b926ffa Sonivox: add SafetyNet log.
4ad85f6 Sonivox: sanity check numSamples.
224d96d Check segments and libs
1c56a7e Sonivox: check loopStart/loopLength against one specific wave, not whole wave pool.
8cd7f81 Sonivox: fix overflow in Parse_data in eas_mdls.c
ebe5523 Sonivox: make sure waveIndex is valid in Parse_rgn() in eas_mdls.c.

   * external/sqlite
a3aff41 sqlite: upgrade to patched SQLite 3.7.11 - DO NOT MERGE

   * external/tremolo
e5fb631 libvorbisidec: sanity check index of marker.
84f7802 Fix vorbis decoder crash due to out of bounds memory access
aec79a4 Fix allocation failure crash
b6a2eee Add sanity checks to fix crash

   * external/wpa_supplicant_8
222f431 Guard against return value already being null
d424951 Remove newlines from config output
1c78404 NFC: Fix payload length validation in NDEF record parser
6cd2401 WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
d1106ab EAP-pwd peer: Fix last fragment length validation
f1a1108 EAP-pwd server: Fix last fragment length validation
77ebbf5 EAP-pwd peer: Fix error path for unexpected Confirm message
4060a8f EAP-pwd peer: Fix asymmetric fragmentation behavior
84b0fb9 EAP-pwd server: Fix Total-Length parsing for fragment reassembly
dcf16cc EAP-pwd peer: Fix Total-Length parsing for fragment reassembly
b80a22d EAP-pwd server: Fix payload length validation for Commit and Confirm
9d163e3 EAP-pwd peer: Fix payload length validation for Commit and Confirm
01d5bf8 AP WMM: Fix integer underflow in WMM Action frame parser
a549bf5 WPS: Fix HTTP chunked transfer encoding parser

   * frameworks/av
7a0a4d2 DO NOT MERGE codecs: check OMX buffer size before use in vorbisdec
5025ff3 DO NOT MERGE codecs: check OMX buffer size before use in (h263|h264)dec
57c8eb8 SampleTable.cpp: Fixed a regression caused by a fix for bug 28076789.
a396972 SampleTable.cpp: Prevent corrupted stts block from causing excessive memory allocation.
07d4189 DO NOT MERGE Don't reject "thumbnail mode" setConfig
7a249c3 DO NOT MERGE Verify OMX buffer sizes prior to access
2317a2b AudioSource: initialize variables
e82ab75 Check mp3 output buffer size
29ee1e9 DO NOT MERGE codecs: check OMX buffer size before use in (gsm|g711)dec
9cf2c18 h264dec: check for overflows when calculating allocation size.
78a6f87 Fix AMR decoder
99939b0 SoftAMR: check input buffer size to avoid overflow.
bfceb25 SoftAMR: check output buffer size to avoid overflow.
e11a487 DO NOT MERGE codecs: check OMX buffer size before use in VP8 encoder.
2f0c431 NuPlayerStreamListener: NULL and bounds check before memcpy
b9aef66 Camera3Device: Validate template ID
5110bcc DO NOT MERGE Add VPX output buffer size check
2167715 Also fix out of bounds access for normal read
b27b364 Get service by value instead of reference
198eff0 Clear allocation to avoid info leak
6911d18 DO NOT MERGE - Remove deprecated image defines
54846c3 Camera: Disallow dumping clients directly
955bedf fix possible overflow in effect wrappers.
ae87c00 Fix out-of-bounds write
d43d4cb DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
882791a DO NOT MERGE SoundPool: add lock for findSample access from SoundPoolThread
d5d8c1d DO NOT MERGE - AudioFlinger: Clear record buffers when starting RecordThread
0e00f01 DO NOT MERGE - OMX: allow only secure codec to remotely call allocateBuffer.
ac85e85 ID3: check possible integer overflow for extendedHeaderSize and paddingSize.
fbf2cec Check NAL size before use
933b093 MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData.
c4f36d3 Don't crash when there's no conceal frame
b9369b9 DO NOT MERGE stagefright: fix AMessage::FromParcel
28acbc8 DO NOT MERGE Fix vulnerability in mediaserver
9b2a7f2 DO NOT MERGE NuCachedSource2: fix possible erroneous early free
5873008 Limit allocations to avoid out-of-memory
92b4787 Fix heap data leak vulnerability
5ce45a2 Fix for security vulnerability in media server DO NOT MERGE
86570d2 DO NOT MERGE - IAudioFlinger: always initialize variables to ensure no info leak when writing them to Parcel.
12a2014 Make IEffect command more robust (second try)
d1acab9 libmedia: clear reply data for IEffect command
ba1d568 Fix timedtext parsing
064a7e4 DO NOT MERGE - libstagefright: sanity check size before dereferencing pointer in Utils.cpp
879442a DO NOT MERGE fix build
cc76163 DO NOT MERGE Avoid size_t overflow in base64 decoding once again
bfa8b8d Ogg: avoid size_t overflow in base64 decoding
b129e0d DO NOT MERGE - IAudioFlinger: clear config before reading it from parcel.
ca36121 Zero out return values in media binder calls
231e1d9 IMediaPlayer.cpp: make sure structures are initialized to 0
07d491d stagefright: check IMemory::pointer() before using the allocation
1a43e1e Fail more gracefully on allocation failure
20bafbc Fix compile failure after rI431aa2b7d30a942350ab6d105451c6b77e2f99d4
8c5c143 libstagefright: fix overflow in pvdec_api.cpp.
23f57b6 libstagefright: check memory size for overflow before allocation.
3036568 Fix for memory corruption in ID3::removeUnsynchronizationV2_4(). Bug: 23227354
1d13da4 Fix build break DO NOT MERGE
7485da5 Fix crash on malformed id3
791804d libstagefright: fix possible overflow in amrwbenc.
1ea4e5d DO NOT MERGE - audio flinger: fix fuzz test crash
5fcaf16 DO NOT MERGE Part of fix for libmedia OOB write anywhere
be85917 libstagefright: fix possible overflow in ID3.
d79af09 Prevent integer issues in ID3::Iterator::findFrame
7fec270 SampleTable: fix integer overflow checks.
fc85b4d Extra sanity checks on sample size and resolution
3fec328 libstagefright: check overflow before memory allocation in OMXCodec.cpp
1add19b Sanity check padding/delay values for gapless playback
57dd075 MatroskaExtractor: detect infinite loop when parsing NALs
5263b0a DO NOT MERGE libstagefright: Fix crash in convertMetaDataToMessage
cb87203 Fix Ogg album art
8275b47 Fix comparison sign warnings.
3d75bcf libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
d87e881 MPEG4Extractor.cpp: Add check for size == SIZE_MAX
a61ca48 Check RTSP payload length
bed69c4 ABuffer: reset members when memory allocation fails.
1bd3761 DO NOT MERGE - Fix software video decoder buffer size calculation
e37fa84 DO NOT MERGE - SoftwareRenderer: sanity check buffer size before copying data.
806c716 Check vector size before accessing
39addd4 SoftAVCEnc: check requested memory size before allocation.
85db3f0 Check buffer size before using it
5396ca2 MPEG4Source::fragmentedRead: check range before writing into buffers
adb0333 do not dequeue from native window after we hit fatal error -- DO NOT MERGE
af8bd6e libstagefright: fix handling of mSampleTimeEntries and mNumSampleSizes in SampleTable.
de62a60 libstagefright: check remaining data size before parsing it.
749ffc9 Check integer overflow to prevent memory corruption
273449c Guard against codecinfo overflow

   * frameworks/base
4d023ca DO NOT MERGE Redact Account info from getCurrentSyncs
cca57f5 NPE fix for SyncStorageEngine read authority
d046d93 AppOps: fix wifi scan op
fa71dc0 Sync extras bundle comparison can throw NPE
74fdccf Make Bitmap_createFromParcel check the color count. DO NOT MERGE
c7d9ada DO NOT MERGE - Backport of ag/748165 to klp-dev Security patch level in Settings
d813014 Allow debugging only for apps forked from zygote DO NOT MERGE
7f332ba DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes
a09a739 Check that the parcel contained the expected amount of region data. DO NOT MERGE

   * frameworks/native
1d11b3d Fix issue #27252896: Security Vulnerability -- weak binder
9c55c87 DO NOT MERGE BQ: fix some uninitialized variables
120aa0d Merge conflict--DO NOT MERGE Add SN logging
2674981 Sanity check IMemory access versus underlying mmap
a4bc69d DO NOT MERGE BQ: Add permission check to BufferQueueConsumer::dump
fbf80e2 IGraphicBufferProducer: fix QUEUE_BUFFER info leak
1b6afeb DO NOT MERGE: fix build try #2
e08cbda DO NOT MERGE: fix build breakage
df18096 add number constraint for samples per MotionEvent
a82fb1e Disregard alleged binder entities beyond parcel bounds
7d6f940 Update maxNumber to be smaller.
33a5e13 Fix for corruption when numFds or numInts is too large.
61998d4 Initialize local variables to avoid data leak

   * frameworks/opt/telephony
e54009e Externally-reported Moderate severity vulnerability in SMS: Apps can bypass the SMS short code notification prompt

   * hardware/qcom/media
efa4187 DO NOT MERGE mm-video-v4l2: vidc: validate omx param/config data
e367995 DO NOT MERGE mm-video-v4l2: vdec: add safety checks for freeing buffers
6945ec2 DO NOT MERGE mm-video-v4l2: venc: add safety checks for freeing buffers
095820a DO NOT MERGE mm-video-v4l2: vdec: deprecate unused config OMX_IndexVendorVideoExtraData

   * libcore
5549787 DO NOT MERGE Prevent duplicate certificates in TrustedCertificateIndex
02e4d22 DO NOT MERGE Cache intermediate CA separately

   * packages/apps/Bluetooth
398e640 DO NOT MERGE Fix security vulnerabilities in permission of deleting MMS/SMS

   * packages/apps/CMAccount
e120a76 Remove account authenticator abilities
ff8a359 Allow as SetupWizard only

   * packages/apps/CertInstaller
8a997d4 Trust CA certificates added for the whole OS only

   * packages/apps/LockClock
c2dc289 LockClock : Switch over to new yahoo location api
3947317 cLock: Use HTTPS for Yahoo Weather API communication

   * packages/apps/Settings
15e214e Add translations for Security Patch Level.
82e036d Present the security patch date in a human-friendly format
f3fcb88 DO NOT MERGE - Backport of ag/748147 - Security Patch Level in Settings CL#3/3
31739cb Check for special char when renaming device for Wi-Fi direct.

   * packages/apps/UnifiedEmail
48d8629 Disallow attachments from file:///data/

   * packages/inputmethods/LatinIME
f7d8a1c LatinIME: Fix dicttool build

   * packages/providers/DownloadProvider
32e5425 Merge conflict--DO NOT MERGE. Use resolved path for both checking and opening.

   * packages/services/Telephony
10bbf80 DO NOT MERGE - Prevent "add-call" UI during setup wizard.

   * system/core
6541efe Fix overflow in path building
cfe51bf Don't demangle symbol names. DO NOT MERGE
6648583 Don't create tombstone directory. DO NOT MERGE
4932940 debuggerd: use O_NOFOLLOW|O_CLOEXEC for tombstones. DO NOT MERGE
aa7cfb4 Revert "Make tombstones directory to not follow symlink."
b72656d ensure /data/tombstones exists on all Android device. DO NOT MERGE
b0cb2ce Add macro to call event logger for errors. DO NOT MERGE
6bac0a9 libutils: Fix integer overflows in VectorImpl. DO NOT MERGE
f49bbc4 Fix compile failure after rIfe1dc0791040150132bea6884f1e6c8d31972d1b
f7a83e5 libutils: fix overflow in String8::allocFromUTF8
c60568a libutils: fix overflow in SharedBuffer

   * system/security
4cf5c0d Properly check for Blob max length
291aaf5 Fix unchecked length in Blob creation

   * vendor/cm
a9b5d98 Revert "config: common.mk: Remove deprecated CMAccount"
08843f3 config: common.mk: Remove deprecated CMAccount
a68b717 config: telephony.mk: Remove deprecated WhisperPush

===================================
Since Sun Oct  4 14:34:24 UTC 2015
===================================

   * packages/apps/LockClock
e1bb691 LockClock : Add api key for open weather

===================================
Since Sun Sep  6 22:02:52 UTC 2015
===================================

   * android
311a74d manifest: Remove vendor/cyngn repo

   * frameworks/base
9649fbc National roaming info for new Tuenti MNC in Spain

   * vendor/cm
4eea643 Add new Tuenti MNC SPN override name

