From d82f8a9a3869448e6d7d4b3fc962e34e33a1ba0e Mon Sep 17 00:00:00 2001 From: Raph Levien Date: Wed, 12 Nov 2014 15:05:16 -0800 Subject: [PATCH] Check bounds on CharSequence drawText methods The canvas drawText() methods on CharSequence arguments didn't check whether the start and end offsets were within bounds, which triggered native crashes. This patch checks the bounds and throws IndexOutOfBoundsException when invalid. Bug: 18282500 Change-Id: I1935bf21f828b960c817b40ebce6affd4ce8bb99 --- core/java/android/view/GLES20Canvas.java | 3 +++ graphics/java/android/graphics/Canvas.java | 3 +++ 2 files changed, 6 insertions(+) diff --git a/core/java/android/view/GLES20Canvas.java b/core/java/android/view/GLES20Canvas.java index b86455ace7b5f..61db9697308b3 100644 --- a/core/java/android/view/GLES20Canvas.java +++ b/core/java/android/view/GLES20Canvas.java @@ -885,6 +885,9 @@ class GLES20Canvas extends HardwareCanvas { @Override public void drawText(CharSequence text, int start, int end, float x, float y, Paint paint) { + if ((start | end | (end - start) | (text.length() - end)) < 0) { + throw new IndexOutOfBoundsException(); + } if (text instanceof String || text instanceof SpannedString || text instanceof SpannableString) { nDrawText(mRenderer, text.toString(), start, end, x, y, paint.mBidiFlags, diff --git a/graphics/java/android/graphics/Canvas.java b/graphics/java/android/graphics/Canvas.java index f45c0cb1b7248..32b0950d1c96d 100644 --- a/graphics/java/android/graphics/Canvas.java +++ b/graphics/java/android/graphics/Canvas.java @@ -1644,6 +1644,9 @@ public class Canvas { */ public void drawText(@NonNull CharSequence text, int start, int end, float x, float y, @NonNull Paint paint) { + if ((start | end | (end - start) | (text.length() - end)) < 0) { + throw new IndexOutOfBoundsException(); + } if (text instanceof String || text instanceof SpannedString || text instanceof SpannableString) { native_drawText(mNativeCanvasWrapper, text.toString(), start, end, x, y,