diff options
| author | 2022-10-05 20:39:19 +0000 | |
|---|---|---|
| committer | 2022-10-05 20:39:19 +0000 | |
| commit | 0d20f4e7232001db6277acc59e418cba87534b63 (patch) | |
| tree | 5643533bf7ef973d9d53f786811a2d356ef6a906 | |
| parent | dda1043288ad2197e8e580b2ead2ffeed87d5b7e (diff) | |
| parent | f0c1daa171bd560fd408b060db1a22a7cb8aa0de (diff) | |
Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-dev am: f0c1daa171
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20111890
Change-Id: If3a349a3d6285c140937265832586178dab55df5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | core/java/android/os/Parcel.java | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index 3d701389a98e..a7349f9e473e 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java @@ -4388,6 +4388,9 @@ public final class Parcel { int type = readInt(); if (isLengthPrefixed(type)) { int objectLength = readInt(); + if (objectLength < 0) { + return null; + } int end = MathUtils.addOrThrow(dataPosition(), objectLength); int valueLength = end - start; setDataPosition(end); |