Merge "Add better index checks for AndroidCharacter.mirror"

2 files changed, 7 insertions, 1 deletions

diff --git a/core/java/android/text/AndroidCharacter.java b/core/java/android/text/AndroidCharacter.java
index af93b5d3772b..05887c551d8d 100644
--- a/core/java/android/text/AndroidCharacter.java
+++ b/core/java/android/text/AndroidCharacter.java
@@ -73,6 +73,11 @@ public class AndroidCharacter
      * Replace the specified slice of <code>text</code> with the chars'
      * right-to-left mirrors (if any), returning true if any
      * replacements were made.
+     *
+     * @param text array of characters to apply mirror operation
+     * @param start first character in array to mirror
+     * @param count maximum number of characters to mirror
+     * @return true if replacements were made
      */
     public native static boolean mirror(char[] text, int start, int count);
 
diff --git a/core/jni/android_text_AndroidCharacter.cpp b/core/jni/android_text_AndroidCharacter.cpp
index 1353478f39f4..5d8d41950646 100644
--- a/core/jni/android_text_AndroidCharacter.cpp
+++ b/core/jni/android_text_AndroidCharacter.cpp
@@ -165,7 +165,8 @@ static jboolean mirror(JNIEnv* env, jobject obj, jcharArray charArray, int start
         goto MIRROR_END;
     }
 
-    if (start > start + count || env->GetArrayLength(charArray) < count) {
+    if (start < 0 || start > start + count
+            || env->GetArrayLength(charArray) < start + count) {
         jniThrowException(env, "java/lang/ArrayIndexOutOfBoundsException", NULL);
         goto MIRROR_END;
     }