Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check bounds on CharSequence drawText methods

Browse Source 
The canvas drawText() methods on CharSequence arguments didn't check
whether the start and end offsets were within bounds, which triggered
native crashes. This patch checks the bounds and throws
IndexOutOfBoundsException when invalid.

Bug: 18282500
Change-Id: I1935bf21f828b960c817b40ebce6affd4ce8bb99
This commit is contained in:
Raph Levien
2014-11-12 15:05:16 -08:00
parent 705c9c131a
commit d82f8a9a38
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/view/GLES20Canvas.java
View File

@@ -885,6 +885,9 @@ class GLES20Canvas extends HardwareCanvas {
@Override
public void drawText(CharSequence text, int start, int end, float x, float y, Paint paint) {
if ((start | end | (end - start) | (text.length() - end)) < 0) {
throw new IndexOutOfBoundsException();
}
if (text instanceof String || text instanceof SpannedString ||
text instanceof SpannableString) {
nDrawText(mRenderer, text.toString(), start, end, x, y, paint.mBidiFlags,

3
graphics/java/android/graphics/Canvas.java
View File

@@ -1644,6 +1644,9 @@ public class Canvas {
*/
public void drawText(@NonNull CharSequence text, int start, int end, float x, float y,
@NonNull Paint paint) {
if ((start | end | (end - start) | (text.length() - end)) < 0) {
throw new IndexOutOfBoundsException();
}
if (text instanceof String || text instanceof SpannedString ||
text instanceof SpannableString) {
native_drawText(mNativeCanvasWrapper, text.toString(), start, end, x, y,