Use a file descriptor in decodeFile.

When trying to decode a file, using a stream can lead to a
pathological case where the entire file is read into memory.
If a large file is encountered, the entire file will be read
into memory and result in different types of crashes.

So instead of using a stream, use a file descriptor to prevent
this case.

Bug: 309868782

Test: Put a large file on the system. Start the files app and
Test: observe no crashes.
Change-Id: I59cbab80af68eb3da4b46df81a5c26bf041778d8

1 files changed, 9 insertions, 6 deletions

diff --git a/graphics/java/android/graphics/BitmapFactory.java b/graphics/java/android/graphics/BitmapFactory.java
index 1da8e189d768..d915b746e0cc 100644
--- a/graphics/java/android/graphics/BitmapFactory.java
+++ b/graphics/java/android/graphics/BitmapFactory.java
@@ -25,10 +25,13 @@ import android.content.res.AssetManager;
 import android.content.res.Resources;
 import android.os.Build;
 import android.os.Trace;
+import android.system.OsConstants;
 import android.util.DisplayMetrics;
 import android.util.Log;
 import android.util.TypedValue;
 
+import libcore.io.IoBridge;
+
 import java.io.FileDescriptor;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -523,19 +526,19 @@ public class BitmapFactory {
     public static Bitmap decodeFile(String pathName, Options opts) {
         validate(opts);
         Bitmap bm = null;
-        InputStream stream = null;
+        FileDescriptor fd = null;
         try {
-            stream = new FileInputStream(pathName);
-            bm = decodeStream(stream, null, opts);
+            fd = IoBridge.open(pathName, OsConstants.O_RDONLY);
+            bm = decodeFileDescriptor(fd, null, opts);
         } catch (Exception e) {
             /*  do nothing.
                 If the exception happened on open, bm will be null.
             */
-            Log.e("BitmapFactory", "Unable to decode stream: " + e);
+            Log.e("BitmapFactory", "Unable to decode file: " + e);
         } finally {
-            if (stream != null) {
+            if (fd != null) {
                 try {
-                    stream.close();
+                    IoBridge.closeAndSignalBlockedThreads(fd);
                 } catch (IOException e) {
                     // do nothing here
                 }