Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make a11y node info parceling more robust

Browse Source 
Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.

Bug: 36491278
Test: Verified that POC no longer works, a11y cts still passes.

(Manual merge from commit 687bb44b43)

Change-Id: I7746c9175a2da28f75d4f4b169d7997abadf1852
This commit is contained in:
Phil Weaver
2017-04-07 14:39:27 -07:00
parent de9cb7ed68
commit 1d8eb49073
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
core/java/android/view/accessibility/AccessibilityNodeInfo.java
View File

@@ -2478,16 +2478,19 @@ public class AccessibilityNodeInfo implements Parcelable {
if (mActions != null && !mActions.isEmpty()) { if (mActions != null && !mActions.isEmpty()) {
final int actionCount = mActions.size(); final int actionCount = mActions.size();
parcel.writeInt(actionCount);
int nonLegacyActionCount = 0;
int defaultLegacyStandardActions = 0; int defaultLegacyStandardActions = 0;
for (int i = 0; i < actionCount; i++) { for (int i = 0; i < actionCount; i++) {
AccessibilityAction action = mActions.get(i); AccessibilityAction action = mActions.get(i);
if (isDefaultLegacyStandardAction(action)) { if (isDefaultLegacyStandardAction(action)) {
defaultLegacyStandardActions |= action.getId(); defaultLegacyStandardActions |= action.getId();
} else {
nonLegacyActionCount++;
} }
} }
parcel.writeInt(defaultLegacyStandardActions); parcel.writeInt(defaultLegacyStandardActions);
parcel.writeInt(nonLegacyActionCount);
for (int i = 0; i < actionCount; i++) { for (int i = 0; i < actionCount; i++) {
AccessibilityAction action = mActions.get(i); AccessibilityAction action = mActions.get(i);
@@ -2498,6 +2501,7 @@ public class AccessibilityNodeInfo implements Parcelable {
} }
} else { } else {
parcel.writeInt(0); parcel.writeInt(0);
parcel.writeInt(0);
} }
parcel.writeInt(mMaxTextLength); parcel.writeInt(mMaxTextLength);
@@ -2656,17 +2660,14 @@ public class AccessibilityNodeInfo implements Parcelable {
mBoundsInScreen.left = parcel.readInt(); mBoundsInScreen.left = parcel.readInt();
mBoundsInScreen.right = parcel.readInt(); mBoundsInScreen.right = parcel.readInt();
final int actionCount = parcel.readInt();
if (actionCount > 0) {
final int legacyStandardActions = parcel.readInt(); final int legacyStandardActions = parcel.readInt();
addLegacyStandardActions(legacyStandardActions); addLegacyStandardActions(legacyStandardActions);
final int nonLegacyActionCount = actionCount - Integer.bitCount(legacyStandardActions); final int nonLegacyActionCount = parcel.readInt();
for (int i = 0; i < nonLegacyActionCount; i++) { for (int i = 0; i < nonLegacyActionCount; i++) {
AccessibilityAction action = new AccessibilityAction( final AccessibilityAction action = new AccessibilityAction(
parcel.readInt(), parcel.readCharSequence()); parcel.readInt(), parcel.readCharSequence());
addAction(action); addAction(action);
} }
}
mMaxTextLength = parcel.readInt(); mMaxTextLength = parcel.readInt();
mMovementGranularities = parcel.readInt(); mMovementGranularities = parcel.readInt();