From ec2952bc4a15b9aa1bfc7e1b0c572aeb719b9a6c Mon Sep 17 00:00:00 2001 From: Shunta Sato Date: Fri, 4 Nov 2016 18:57:39 +0900 Subject: [PATCH] Don't allow the negative height of ListPopupWindow Symptom: If an application set a negative height to the popup list, surfaceflinger is crashed with SIGABRT. Root cause: WindowManagerService dose not expect negative height of ListPopupWindow. If it's negative, WindowManagerService set the negative value to GraphicBufferAlloc, but GraphicBufferAlloc handle the value as unsigned int, then surfaceflinger is crashed with SIGABRT. Solution: Setting a negative height is a developer error. We should throw an IAE from setHeigh(int). Bug: 33441454 Author: Kazuki Nakayama Change-Id: I5887674d302e567abfe66147de4819cfdf0ef97b --- core/java/android/widget/ListPopupWindow.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/core/java/android/widget/ListPopupWindow.java b/core/java/android/widget/ListPopupWindow.java index 78d18fdbca5ff..ab4cce4790056 100644 --- a/core/java/android/widget/ListPopupWindow.java +++ b/core/java/android/widget/ListPopupWindow.java @@ -523,9 +523,17 @@ public class ListPopupWindow implements ShowableListMenu { /** * Sets the height of the popup window in pixels. Can also be {@link #MATCH_PARENT}. * - * @param height Height of the popup window. + * @param height Height of the popup window must be a positive value, + * {@link #MATCH_PARENT}, or {@link #WRAP_CONTENT}. + * + * @throws IllegalArgumentException if height is set to negative value */ public void setHeight(int height) { + if (height < 0 && ViewGroup.LayoutParams.WRAP_CONTENT != height + && ViewGroup.LayoutParams.MATCH_PARENT != height) { + throw new IllegalArgumentException( + "Invalid height. Must be a positive value, MATCH_PARENT, or WRAP_CONTENT."); + } mDropDownHeight = height; }