Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-dev

Browse Source
This commit is contained in:
Hao Ke
2022-10-05 20:03:28 +00:00
committed by Android (Google) Code Review
parent 3c8ae9c1de 3468327549
commit f0c1daa171
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/os/Parcel.java
View File

@@ -4388,6 +4388,9 @@ public final class Parcel {
int type = readInt(); int type = readInt();
if (isLengthPrefixed(type)) { if (isLengthPrefixed(type)) {
int objectLength = readInt(); int objectLength = readInt();
if (objectLength < 0) {
return null;
}
int end = MathUtils.addOrThrow(dataPosition(), objectLength); int end = MathUtils.addOrThrow(dataPosition(), objectLength);
int valueLength = end - start; int valueLength = end - start;
setDataPosition(end); setDataPosition(end);