diff options
| author | 2022-10-05 21:28:39 +0000 | |
|---|---|---|
| committer | 2022-10-05 21:28:39 +0000 | |
| commit | 7c4f30abe0031719f61d68e65a301885c47ddc2a (patch) | |
| tree | ee15455e2d48c9f7604c87079a447343c3d8a342 | |
| parent | 3971e8449d1e082d503a65f509e467fe4423f14c (diff) | |
| parent | a7af799f90a5e9930c5f5095aad27149679963d4 (diff) | |
Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-qpr-dev am: 1616c18830 am: a7af799f90
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20111891
Change-Id: I05cb905d2d9c18035b59d2232a25930c2ad8198e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | core/java/android/os/Parcel.java | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index adae034536fb..d451765f022f 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java @@ -4418,6 +4418,9 @@ public final class Parcel { int type = readInt(); if (isLengthPrefixed(type)) { int objectLength = readInt(); + if (objectLength < 0) { + return null; + } int end = MathUtils.addOrThrow(dataPosition(), objectLength); int valueLength = end - start; setDataPosition(end); |