-m CtsSecurityTestCases -t android.security.cts.StagefrightTest#testStagefright_bug_34896431

如下patch即可。
diff --git a/drivers/media/platform/msm/vidc/msm_vdec.c b/drivers/media/platform/msm/vidc/msm_vdec.c
index 86b7b1b..579f032 100644
--- a/drivers/media/platform/msm/vidc/msm_vdec.c
+++ b/drivers/media/platform/msm/vidc/msm_vdec.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -22,6 +22,7 @@
 #define MSM_VDEC_DVC_NAME "msm_vdec_8974"
 #define MIN_NUM_OUTPUT_BUFFERS 4
 #define MIN_NUM_OUTPUT_BUFFERS_VP9 6
+#define MIN_NUM_OUTPUT_BUFFERS_HEVC 5
 #define MIN_NUM_CAPTURE_BUFFERS 6
 #define MIN_NUM_THUMBNAIL_MODE_CAPTURE_BUFFERS 1
 #define MAX_NUM_OUTPUT_BUFFERS VB2_MAX_FRAME
@@ -1494,6 +1495,10 @@ static int msm_vdec_queue_setup(struct vb2_queue *q,
                V4L2_PIX_FMT_VP9 &&
                *num_buffers < MIN_NUM_OUTPUT_BUFFERS_VP9)
            *num_buffers = MIN_NUM_OUTPUT_BUFFERS_VP9;
+       else if (inst->fmts[OUTPUT_PORT].fourcc ==
+               V4L2_PIX_FMT_HEVC &&
+               *num_buffers < MIN_NUM_OUTPUT_BUFFERS_HEVC)
+           *num_buffers = MIN_NUM_OUTPUT_BUFFERS_HEVC;

        for (i = 0; i < *num_planes; i++) {
            sizes[i] = get_frame_size(inst,