commit 4428c46dd10ff39f10fc6556348f5fd739cc39f2
author Steven Moreland <smoreland@google.com> Tue Dec 10 21:54:36 2024 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Feb 18 17:47:59 2025 -0800
tree 688fd0fd4bad4f3efcac1c78d81a4fb166cebe1f
parent dad8e74af957be766834c3679c00923cee0d63cc

BaseBundle: fix unparcel error logic

This code considered a success case to be an unsuccessful
case.

Bug: 373357090
Test: repro in bug no longer works
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:86cfb77a4664110c44ea147e8457a65e69e6d5d9)
Merged-In: Id423936872cbb0e0265ccf2855092357cb175d47
Change-Id: Id423936872cbb0e0265ccf2855092357cb175d47

core/java/android/os/BaseBundle.java

diff --git a/core/java/android/os/BaseBundle.java b/core/java/android/os/BaseBundle.java
index 5012127..e2315d5 100644
--- a/core/java/android/os/BaseBundle.java
+++ b/core/java/android/os/BaseBundle.java
@@ -475,10 +475,10 @@
             map.erase();
             map.ensureCapacity(count);
         }
-        int numLazyValues = 0;
+        int[] numLazyValues = new int[]{0};
         try {
-            numLazyValues = parcelledData.readArrayMap(map, count, !parcelledByNative,
-                    /* lazy */ ownsParcel, mClassLoader);
+            parcelledData.readArrayMap(map, count, !parcelledByNative,
+                    /* lazy */ ownsParcel, mClassLoader, numLazyValues);
         } catch (BadParcelableException e) {
             if (sShouldDefuse) {
                 Log.w(TAG, "Failed to parse Bundle, but defusing quietly", e);
@@ -489,14 +489,14 @@
         } finally {
             mWeakParcelledData = null;
             if (ownsParcel) {
-                if (numLazyValues == 0) {
+                if (numLazyValues[0] == 0) {
                     recycleParcel(parcelledData);
                 } else {
                     mWeakParcelledData = new WeakReference<>(parcelledData);
                 }
             }
 
-            mLazyValues = numLazyValues;
+            mLazyValues = numLazyValues[0];
             mParcelledByNative = false;
             mMap = map;
             // Set field last as it is volatile

core/java/android/os/Parcel.java

diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
index cf473ec..26f768c 100644
--- a/core/java/android/os/Parcel.java
+++ b/core/java/android/os/Parcel.java
@@ -5538,7 +5538,7 @@
 
     private void readArrayMapInternal(@NonNull ArrayMap<? super String, Object> outVal,
             int size, @Nullable ClassLoader loader) {
-        readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader);
+        readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader, null);
     }
 
     /**
@@ -5548,17 +5548,16 @@
      * @param lazy   Whether to populate the map with lazy {@link Function} objects for
      *               length-prefixed values. See {@link Parcel#readLazyValue(ClassLoader)} for more
      *               details.
-     * @return a count of the lazy values in the map
+     * @param lazyValueCount number of lazy values added here
      * @hide
      */
-    int readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
-            boolean lazy, @Nullable ClassLoader loader) {
-        int lazyValues = 0;
+    void readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
+            boolean lazy, @Nullable ClassLoader loader, int[] lazyValueCount) {
         while (size > 0) {
             String key = readString();
             Object value = (lazy) ? readLazyValue(loader) : readValue(loader);
             if (value instanceof LazyValue) {
-                lazyValues++;
+                lazyValueCount[0]++;
             }
             if (sorted) {
                 map.append(key, value);
@@ -5570,7 +5569,6 @@
         if (sorted) {
             map.validate();
         }
-        return lazyValues;
     }
 
     /**