diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index 7f9f720ce9c3a..fc4bb6a41b863 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java @@ -4422,6 +4422,9 @@ public final class Parcel { int type = readInt(); if (isLengthPrefixed(type)) { int objectLength = readInt(); + if (objectLength < 0) { + return null; + } int end = MathUtils.addOrThrow(dataPosition(), objectLength); int valueLength = end - start; setDataPosition(end);