Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle bad ninepatch data.

Browse Source 
Changes proposed by Ben Hawkes of Google Project Zero.

NinePatchPeeker.cpp:
Instead of asserting, return false for bad data.

ResourceTypes.h:
Store ninepatch values as unsigned.

BUG:19151999
Change-Id: Ibe35e7569f632c6bb8a34a7701e26bb6ed547ec2
This commit is contained in:
Leon Scroggins III
2015-01-27 11:12:02 -05:00
committed by Leon Scroggins
parent aa6945ac79
commit a730ef3f77
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/jni/android/graphics/NinePatchPeeker.cpp
View File

@@ -24,7 +24,9 @@ bool NinePatchPeeker::peek(const char tag[], const void* data, size_t length) {
if (!strcmp("npTc", tag) && length >= sizeof(Res_png_9patch)) {
Res_png_9patch* patch = (Res_png_9patch*) data;
size_t patchSize = patch->serializedSize();
assert(length == patchSize);
if (length != patchSize) {
return false;
}
// You have to copy the data because it is owned by the png reader
Res_png_9patch* patchNew = (Res_png_9patch*) malloc(patchSize);
memcpy(patchNew, patch, patchSize);

6
include/androidfw/ResourceTypes.h
View File

@@ -118,9 +118,9 @@ struct Res_png_9patch
yDivsOffset(0), colorsOffset(0) { }
int8_t wasDeserialized;
int8_t numXDivs;
int8_t numYDivs;
int8_t numColors;
uint8_t numXDivs;
uint8_t numYDivs;
uint8_t numColors;
// The offset (from the start of this structure) to the xDivs & yDivs
// array for this 9patch. To get a pointer to this array, call