Merge "Handle integer overflow in BaseInputConnection" into udc-dev

core/java/android/view/inputmethod/BaseInputConnection.java

@@ -622,15 +622,11 @@ public class BaseInputConnection implements InputConnection {
         if (b < 0) {
             b = 0;
         }
-
+        int end = (int) Math.min((long) b + length, content.length());
-        if (b + length > content.length()) {
-            length = content.length() - b;
-        }
-
         if ((flags&GET_TEXT_WITH_STYLES) != 0) {
-            return content.subSequence(b, b + length);
+            return content.subSequence(b, end);
         }
-        return TextUtils.substring(content, b, b + length);
+        return TextUtils.substring(content, b, end);
     }
 
     /**
@@ -666,13 +662,9 @@ public class BaseInputConnection implements InputConnection {
             selEnd = tmp;
         }
 
-        int contentLength = content.length();
-        int startPos = selStart - beforeLength;
-        int endPos = selEnd + afterLength;
-
         // Guards the start and end pos within range [0, contentLength].
-        startPos = Math.max(0, startPos);
+        int startPos = Math.max(0, selStart - beforeLength);
-        endPos = Math.min(contentLength, endPos);
+        int endPos = (int) Math.min((long) selEnd + afterLength, content.length());
 
         CharSequence surroundingText;
         if ((flags & GET_TEXT_WITH_STYLES) != 0) {

core/tests/coretests/src/android/view/inputmethod/BaseInputConnectionTest.java

@@ -549,6 +549,14 @@ public class BaseInputConnectionTest {
                                 .isEqualTo(new SurroundingText("456", 0, 3, -1)))
                 .isTrue();
 
+        verifyContentEquals(mBaseInputConnection.getTextBeforeCursor(Integer.MAX_VALUE, 0), "123");
+        verifyContentEquals(mBaseInputConnection.getTextAfterCursor(Integer.MAX_VALUE, 0), "789");
+        assertThat(
+                mBaseInputConnection
+                        .getSurroundingText(Integer.MAX_VALUE, Integer.MAX_VALUE, 0)
+                        .isEqualTo(new SurroundingText("123456789", 3, 6, -1)))
+                .isTrue();
+
         int cursorCapsMode =
                 TextUtils.getCapsMode(
                         "123456789",
@@ -617,6 +625,45 @@ public class BaseInputConnectionTest {
         verifyTextSnapshotContentEquals(mBaseInputConnection.takeSnapshot(), expectedTextSnapshot);
     }
 
+    @Test
+    public void testGetText_emptyText() {
+        // ""
+        prepareContent("", 0, 0, -1, -1);
+
+        verifyContentEquals(mBaseInputConnection.getTextBeforeCursor(1, 0), "");
+        verifyContentEquals(mBaseInputConnection.getTextAfterCursor(1, 0), "");
+        assertThat(mBaseInputConnection.getSelectedText(0)).isNull();
+
+        // This falls back to default implementation in {@code InputConnection}, which always return
+        // -1 for offset.
+        assertThat(
+                mBaseInputConnection
+                        .getSurroundingText(1, 1, 0)
+                        .isEqualTo(new SurroundingText("", 0, 0, -1)))
+                .isTrue();
+
+        verifyContentEquals(mBaseInputConnection.getTextBeforeCursor(0, 0), "");
+        verifyContentEquals(mBaseInputConnection.getTextAfterCursor(0, 0), "");
+        assertThat(mBaseInputConnection.getSelectedText(0)).isNull();
+        // This falls back to default implementation in {@code InputConnection}, which always return
+        // -1 for offset.
+        assertThat(
+                mBaseInputConnection
+                        .getSurroundingText(0, 0, 0)
+                        .isEqualTo(new SurroundingText("", 0, 0, -1)))
+                .isTrue();
+
+        verifyContentEquals(mBaseInputConnection.getTextBeforeCursor(Integer.MAX_VALUE, 0), "");
+        verifyContentEquals(mBaseInputConnection.getTextAfterCursor(Integer.MAX_VALUE, 0), "");
+        assertThat(mBaseInputConnection.getSelectedText(0)).isNull();
+        assertThat(
+                mBaseInputConnection
+                        .getSurroundingText(Integer.MAX_VALUE, Integer.MAX_VALUE, 0)
+                        .isEqualTo(new SurroundingText("", 0, 0, -1)))
+                .isTrue();
+    }
+
+
     @Test
     public void testReplaceText_toEditorWithoutSelectionAndComposing() {
         // before replace: "|"