From fc451f44dcba605f4c185ff7cd4673c1b292bdca Mon Sep 17 00:00:00 2001
From: Hui Yu <huiyu@google.com>
Date: Tue, 11 Sep 2018 17:42:14 -0700
Subject: [PATCH] Check Bundle length is aligned by 4 when readFromParcel.

Otherwise throw an IllegalStateException.
Fix: 26885514
Test: Make the bundle length not aligned by 4 and observe the IllegalStateException.

Change-Id: I57f0d5babdf1b8f1074eb2f4f76b71926db8b93c
---
 core/java/android/os/BaseBundle.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/java/android/os/BaseBundle.java b/core/java/android/os/BaseBundle.java
index 0fef78d1f4bab..3d4c00c3b4800 100644
--- a/core/java/android/os/BaseBundle.java
+++ b/core/java/android/os/BaseBundle.java
@@ -1601,12 +1601,13 @@ public class BaseBundle {
     private void readFromParcelInner(Parcel parcel, int length) {
         if (length < 0) {
             throw new RuntimeException("Bad length in parcel: " + length);
-
         } else if (length == 0) {
             // Empty Bundle or end of data.
             mParcelledData = NoImagePreloadHolder.EMPTY_PARCEL;
             mParcelledByNative = false;
             return;
+        } else if (length % 4 != 0) {
+            throw new IllegalStateException("Bundle length is not aligned by 4: " + length);
         }
 
         final int magic = parcel.readInt();