Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix int overflow in SpannableStringBuilder.replace

Browse Source 
During the offset calculation for selection, SpannableStringBuilder
had an overflow while multiplying two int values. This CL uses long to
calculate the multiplication, and also checks for overflow after
casting the final result into int again.

Bug: 29108549
Change-Id: I11eff4677916701074b38bc5214730fe704707c4
This commit is contained in:
Siyamed Sinir
2016-06-03 16:22:17 -07:00
parent e34bb5a1ff
commit eb4df8a822
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
core/java/android/text/SpannableStringBuilder.java
View File

@@ -19,7 +19,6 @@ package android.text;
import android.annotation.Nullable;
import android.graphics.Canvas;
import android.graphics.Paint;
import android.text.style.ParagraphStyle;
import android.util.Log;
import com.android.internal.util.ArrayUtils;
@@ -554,7 +553,8 @@ public class SpannableStringBuilder implements CharSequence, GetChars, Spannable
if (adjustSelection) {
boolean changed = false;
if (selectionStart > start && selectionStart < end) {
final int offset = (selectionStart - start) * newLen / origLen;
final long diff = selectionStart - start;
final int offset = Math.toIntExact(diff * newLen / origLen);
selectionStart = start + offset;
changed = true;
@@ -562,7 +562,8 @@ public class SpannableStringBuilder implements CharSequence, GetChars, Spannable
Spanned.SPAN_POINT_POINT);
}
if (selectionEnd > start && selectionEnd < end) {
final int offset = (selectionEnd - start) * newLen / origLen;
final long diff = selectionEnd - start;
final int offset = Math.toIntExact(diff * newLen / origLen);
selectionEnd = start + offset;
changed = true;