Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-dev am: f0c1daa171

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20111890

Change-Id: I2ddae3bff3c5ade529b145cec5eab5d65732196c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

core/java/android/os/Parcel.java

@@ -4422,6 +4422,9 @@ public final class Parcel {
         int type = readInt();
         if (isLengthPrefixed(type)) {
             int objectLength = readInt();
+            if (objectLength < 0) {
+                return null;
+            }
             int end = MathUtils.addOrThrow(dataPosition(), objectLength);
             int valueLength = end - start;
             setDataPosition(end);