| commit | 0d20f4e7232001db6277acc59e418cba87534b63 | [log] [tgz] |
|---|---|---|
| author | Hao Ke <haok@google.com> | Wed Oct 05 20:39:19 2022 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Oct 05 20:39:19 2022 +0000 |
| tree | 5643533bf7ef973d9d53f786811a2d356ef6a906 | |
| parent | dda1043288ad2197e8e580b2ead2ffeed87d5b7e [diff] | |
| parent | f0c1daa171bd560fd408b060db1a22a7cb8aa0de [diff] |
Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-dev am: f0c1daa171 Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20111890 Change-Id: If3a349a3d6285c140937265832586178dab55df5 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index 3d70138..a7349f9 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java
@@ -4388,6 +4388,9 @@ int type = readInt(); if (isLengthPrefixed(type)) { int objectLength = readInt(); + if (objectLength < 0) { + return null; + } int end = MathUtils.addOrThrow(dataPosition(), objectLength); int valueLength = end - start; setDataPosition(end);