From b2a831ac3c83b217e5efc7702350c261e5324ebb Mon Sep 17 00:00:00 2001
From: Alex Buynytskyy <alexbuy@google.com>
Date: Mon, 26 Jul 2021 10:04:37 -0700
Subject: [PATCH] Check for invalid (negative) string pool pos.

Parcel implementation would crash the system server otherwise.
Any exception is OK as it'll cause the cache to be invalidated.
Crash is not OK.

Bug: 194632313
Fixes: 194632313
Test: atest PackageParserCacheHelperTest
Change-Id: I58a4496b4646e172e6c3aee9ea17854a7ef55eaa
---
 core/java/android/content/pm/PackageParserCacheHelper.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/java/android/content/pm/PackageParserCacheHelper.java b/core/java/android/content/pm/PackageParserCacheHelper.java
index 8212224e114c9..e03c3ee4fab93 100644
--- a/core/java/android/content/pm/PackageParserCacheHelper.java
+++ b/core/java/android/content/pm/PackageParserCacheHelper.java
@@ -56,6 +56,9 @@ public class PackageParserCacheHelper {
             mStrings.clear();
 
             final int poolPosition = mParcel.readInt();
+            if (poolPosition < 0) {
+                throw new IllegalStateException("Invalid string pool position: " + poolPosition);
+            }
             final int startPosition = mParcel.dataPosition();
 
             // The pool is at the end of the parcel.