diff --git a/core/jni/android_os_Parcel.cpp b/core/jni/android_os_Parcel.cpp index bb4ab39a59d18..1f64df49cb569 100644 --- a/core/jni/android_os_Parcel.cpp +++ b/core/jni/android_os_Parcel.cpp @@ -101,9 +101,18 @@ static void android_os_Parcel_markSensitive(jlong nativePtr) static void android_os_Parcel_markForBinder(JNIEnv* env, jclass clazz, jlong nativePtr, jobject binder) { + LOG_ALWAYS_FATAL_IF(binder == nullptr, "Null binder specified for markForBinder"); + Parcel* parcel = reinterpret_cast(nativePtr); if (parcel) { - parcel->markForBinder(ibinderForJavaObject(env, binder)); + sp nBinder = ibinderForJavaObject(env, binder); + + if (nBinder == nullptr) { + ALOGE("Native binder in markForBinder is null for non-null jobject"); + return; + } + + parcel->markForBinder(nBinder); } } diff --git a/core/jni/android_util_Binder.cpp b/core/jni/android_util_Binder.cpp index f28e2f636dac3..9f88f3369ae8d 100644 --- a/core/jni/android_util_Binder.cpp +++ b/core/jni/android_util_Binder.cpp @@ -798,6 +798,12 @@ sp ibinderForJavaObject(JNIEnv* env, jobject obj) if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) { JavaBBinderHolder* jbh = (JavaBBinderHolder*) env->GetLongField(obj, gBinderOffsets.mObject); + + if (jbh == nullptr) { + ALOGE("JavaBBinderHolder null on binder"); + return nullptr; + } + return jbh->get(env, obj); }