commit bd462745f5c881b8ab904d0ba6d820b54e5f9047
author Jacky Kao <jackykao@google.com> Thu Mar 25 08:49:53 2021 +0800
committer Jacky Kao <jackykao@google.com> Thu Apr 01 11:13:47 2021 +0800
tree ba12c45a9da660d174009011876f3dcb9cab32e0
parent 624a0f2d0e34233db003f884cf1c73fa32201bf8

Limitation the text location length of the A11y node

This issue caused by the input location length is too large to make
the OOM crash when constructing the rectangle array.

Due to the constructed rectangle array needs to send back to services
through the binder transaction, so limiting the text location length
to avoid the binder transaction failure or the OOM crash.

Bug: 159355942
Test: a11y CTS & unit tests
Change-Id: I3b48b8999967347475b830d94d641b45259152ae

core/api/current.txt

diff --git a/core/api/current.txt b/core/api/current.txt
index f428a56..dea5c71 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -50614,6 +50614,7 @@
     field @NonNull public static final android.os.Parcelable.Creator<android.view.accessibility.AccessibilityNodeInfo> CREATOR;
     field public static final String EXTRA_DATA_RENDERING_INFO_KEY = "android.view.accessibility.extra.DATA_RENDERING_INFO_KEY";
     field public static final String EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH = "android.view.accessibility.extra.DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH";
+    field public static final int EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_MAX_LENGTH = 20000; // 0x4e20
     field public static final String EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_START_INDEX = "android.view.accessibility.extra.DATA_TEXT_CHARACTER_LOCATION_ARG_START_INDEX";
     field public static final String EXTRA_DATA_TEXT_CHARACTER_LOCATION_KEY = "android.view.accessibility.extra.DATA_TEXT_CHARACTER_LOCATION_KEY";
     field public static final int FOCUS_ACCESSIBILITY = 2; // 0x2

core/java/android/view/accessibility/AccessibilityNodeInfo.java

diff --git a/core/java/android/view/accessibility/AccessibilityNodeInfo.java b/core/java/android/view/accessibility/AccessibilityNodeInfo.java
index ab46170..1c15bbc 100644
--- a/core/java/android/view/accessibility/AccessibilityNodeInfo.java
+++ b/core/java/android/view/accessibility/AccessibilityNodeInfo.java
@@ -627,7 +627,7 @@
 
     /**
      * Integer argument specifying the end index of the requested text location data. Must be
-     * positive.
+     * positive and no larger than {@link #EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH}.
      *
      * @see #EXTRA_DATA_TEXT_CHARACTER_LOCATION_KEY
      */
@@ -635,6 +635,11 @@
             "android.view.accessibility.extra.DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH";
 
     /**
+     * The maximum allowed length of the requested text location data.
+     */
+    public static final int EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_MAX_LENGTH = 20000;
+
+    /**
      * Key used to request extra data for the rendering information.
      * The key requests that a {@link AccessibilityNodeInfo.ExtraRenderingInfo} be added to this
      * info. This request is made with {@link #refreshWithExtraData(String, Bundle)} without
@@ -1038,6 +1043,14 @@
      * recycled).
      */
     public boolean refreshWithExtraData(String extraDataKey, Bundle args) {
+        // limits the text location length to make sure the rectangle array allocation avoids
+        // the binder transaction failure and OOM crash.
+        if (args.getInt(EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH, -1)
+                > EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_MAX_LENGTH) {
+            args.putInt(EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_LENGTH,
+                    EXTRA_DATA_TEXT_CHARACTER_LOCATION_ARG_MAX_LENGTH);
+        }
+
         args.putString(EXTRA_DATA_REQUESTED_KEY, extraDataKey);
         return refresh(args, true);
     }