diff options
| -rw-r--r-- | core/java/com/android/internal/os/PowerStats.java | 9 | ||||
| -rw-r--r-- | core/tests/coretests/src/com/android/internal/os/PowerStatsTest.java | 14 |
2 files changed, 22 insertions, 1 deletions
diff --git a/core/java/com/android/internal/os/PowerStats.java b/core/java/com/android/internal/os/PowerStats.java index 7c7c7b8fa51d..9f9aae53e0af 100644 --- a/core/java/com/android/internal/os/PowerStats.java +++ b/core/java/com/android/internal/os/PowerStats.java @@ -473,7 +473,14 @@ public final class PowerStats { } finally { // Unconditionally skip to the end of the written data, even if the actual parcel // format is incompatible - parcel.setDataPosition(endPos); + if (endPos > parcel.dataPosition()) { + if (endPos >= parcel.dataSize()) { + throw new IndexOutOfBoundsException( + "PowerStats end position: " + endPos + " is outside the parcel bounds: " + + parcel.dataSize()); + } + parcel.setDataPosition(endPos); + } } } diff --git a/core/tests/coretests/src/com/android/internal/os/PowerStatsTest.java b/core/tests/coretests/src/com/android/internal/os/PowerStatsTest.java index 6402206410b5..baab3b218746 100644 --- a/core/tests/coretests/src/com/android/internal/os/PowerStatsTest.java +++ b/core/tests/coretests/src/com/android/internal/os/PowerStatsTest.java @@ -168,6 +168,20 @@ public class PowerStatsTest { assertThat(end).isEqualTo("END"); } + @Test + public void parceling_corruptParcel() { + PowerStats stats = new PowerStats(mDescriptor); + Parcel parcel = Parcel.obtain(); + stats.writeToParcel(parcel); + + Parcel newParcel = marshallAndUnmarshall(parcel); + newParcel.writeInt(-42); // Negative section length + newParcel.setDataPosition(0); + + PowerStats newStats = PowerStats.readFromParcel(newParcel, mRegistry); + assertThat(newStats).isNull(); + } + private static Parcel marshallAndUnmarshall(Parcel parcel) { byte[] bytes = parcel.marshall(); parcel.recycle(); |