Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b6beed2 authored by Phil Weaver's avatar Phil Weaver
Browse files

Make a11y node info parceling more robust 

Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.

Bug: 36491278
Test: Verified that POC no longer works, a11y cts still passes.
Change-Id: I10f24747e3ab87d77cd1deba56db4526e3aa5441
(cherry picked from commit 687bb44b)
parent 7dfa16c2

core/java/android/view/accessibility/AccessibilityNodeInfo.java

+12 −11
Original line number Diff line number Diff line
@@ -3073,16 +3073,19 @@ public class AccessibilityNodeInfo implements Parcelable { 


        if (mActions != null && !mActions.isEmpty()) {

            final int actionCount = mActions.size();

            parcel.writeInt(actionCount);



            int nonLegacyActionCount = 0;

            int defaultLegacyStandardActions = 0;

            for (int i = 0; i < actionCount; i++) {

                AccessibilityAction action = mActions.get(i);

                if (isDefaultLegacyStandardAction(action)) {

                    defaultLegacyStandardActions |= action.getId();

                } else {

                    nonLegacyActionCount++;

                }

            }

            parcel.writeInt(defaultLegacyStandardActions);

            parcel.writeInt(nonLegacyActionCount);



            for (int i = 0; i < actionCount; i++) {

                AccessibilityAction action = mActions.get(i);
@@ -3093,6 +3096,7 @@ public class AccessibilityNodeInfo implements Parcelable { 
            }

        } else {

            parcel.writeInt(0);

            parcel.writeInt(0);

        }



        parcel.writeInt(mMaxTextLength);
@@ -3270,17 +3274,14 @@ public class AccessibilityNodeInfo implements Parcelable { 
        mBoundsInScreen.left = parcel.readInt();

        mBoundsInScreen.right = parcel.readInt();



        final int actionCount = parcel.readInt();

        if (actionCount > 0) {

        final int legacyStandardActions = parcel.readInt();

        addLegacyStandardActions(legacyStandardActions);

            final int nonLegacyActionCount = actionCount - Integer.bitCount(legacyStandardActions);

        final int nonLegacyActionCount = parcel.readInt();

        for (int i = 0; i < nonLegacyActionCount; i++) {

            final AccessibilityAction action = new AccessibilityAction(

                    parcel.readInt(), parcel.readCharSequence());

            addActionUnchecked(action);

        }

        }



        mMaxTextLength = parcel.readInt();

        mMovementGranularities = parcel.readInt();