Merge "Verify presence of _FileAsset::getBuffer data" into sc-dev am: 13493787d7

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14750308

Change-Id: Id0da28c32fe5bc15ec01906c7d707ec3abc39ca4

libs/androidfw/Asset.cpp

@@ -594,7 +594,12 @@ void _FileAsset::close(void)
  */
 const void* _FileAsset::getBuffer(bool aligned)
 {
-    return getIncFsBuffer(aligned).unsafe_ptr();
+    auto buffer = getIncFsBuffer(aligned);
+    if (mBuf != NULL)
+        return mBuf;
+    if (!buffer.convert<uint8_t>().verify(mLength))
+        return NULL;
+    return buffer.unsafe_ptr();
 }
 
 incfs::map_ptr<void> _FileAsset::getIncFsBuffer(bool aligned)

libs/androidfw/include/androidfw/Asset.h

@@ -91,7 +91,8 @@ public:
      * Get a pointer to a buffer with the entire contents of the file.
      * If `aligned` is true, the buffer data will be aligned to a 4-byte boundary.
      *
-     * Use this function if the asset can never reside on IncFs.
+     * If the buffer contents reside on IncFs, the entire buffer will be scanned to ensure the
+     * presence of the data before returning a raw pointer to the buffer.
      */
     virtual const void* getBuffer(bool aligned) = 0;
 
@@ -99,7 +100,8 @@ public:
      * Get a incfs::map_ptr<void> to a buffer with the entire contents of the file.
      * If `aligned` is true, the buffer data will be aligned to a 4-byte boundary.
      *
-     * Use this function if the asset can potentially reside on IncFs.
+     * Use this function if the asset can potentially reside on IncFs to avoid the scanning of the
+     * buffer contents done in Asset::getBuffer.
      */
     virtual incfs::map_ptr<void> getIncFsBuffer(bool aligned) = 0;