Merge "Validate incoming data properly." into oc-dev (a0aa7c30) · Commits · e / os / android_frameworks_base

core/java/android/os/HwParcel.java

+3 −2

Original line number	Original line	Diff line number	Diff line
	@@ -209,10 +209,11 @@ public class HwParcel {
	public native final IHwBinder readStrongBinder();		public native final IHwBinder readStrongBinder();

	// Handle is stored as part of the blob.		// Handle is stored as part of the blob.
	public native final HwBlob readBuffer();		public native final HwBlob readBuffer(long expectedSize);

	public native final HwBlob readEmbeddedBuffer(		public native final HwBlob readEmbeddedBuffer(
	long parentHandle, long offset, boolean nullable);		long expectedSize, long parentHandle, long offset,
			boolean nullable);

	public native final void writeBuffer(HwBlob blob);		public native final void writeBuffer(HwBlob blob);

core/jni/android_os_HwParcel.cpp

+30 −19

Original line number	Original line	Diff line number	Diff line
	@@ -574,7 +574,7 @@ static jstring JHwParcel_native_readString(JNIEnv *env, jobject thiz) {
	size_t parentHandle;		size_t parentHandle;

	const hidl_string *s;		const hidl_string *s;
	status_t err = parcel->readBuffer(&parentHandle,		status_t err = parcel->readBuffer(sizeof(*s), &parentHandle,
	reinterpret_cast<const void**>(&s));		reinterpret_cast<const void**>(&s));

	if (err != OK) {		if (err != OK) {
	@@ -583,7 +583,7 @@ static jstring JHwParcel_native_readString(JNIEnv *env, jobject thiz) {
	}		}

	err = ::android::hardware::readEmbeddedFromParcel(		err = ::android::hardware::readEmbeddedFromParcel(
	const_cast<hidl_string *>(s),		const_cast<hidl_string &>(*s),
	parcel, parentHandle, 0 / parentOffset */);		parcel, parentHandle, 0 / parentOffset */);

	if (err != OK) {		if (err != OK) {
	@@ -602,7 +602,7 @@ static Type ## Array JHwParcel_native_read ## Suffix ## Vector( \
	size_t parentHandle; \		size_t parentHandle; \
	\		\
	const hidl_vec<Type> *vec; \		const hidl_vec<Type> *vec; \
	status_t err = parcel->readBuffer(&parentHandle, \		status_t err = parcel->readBuffer(sizeof(*vec), &parentHandle, \
	reinterpret_cast<const void**>(&vec)); \		reinterpret_cast<const void**>(&vec)); \
	\		\
	if (err != OK) { \		if (err != OK) { \
	@@ -613,7 +613,7 @@ static Type ## Array JHwParcel_native_read ## Suffix ## Vector( \
	size_t childHandle; \		size_t childHandle; \
	\		\
	err = ::android::hardware::readEmbeddedFromParcel( \		err = ::android::hardware::readEmbeddedFromParcel( \
	const_cast<hidl_vec<Type> *>(vec), \		const_cast<hidl_vec<Type> &>(*vec), \
	*parcel, \		*parcel, \
	parentHandle, \		parentHandle, \
	0 /* parentOffset */, \		0 /* parentOffset */, \
	@@ -645,7 +645,7 @@ static jbooleanArray JHwParcel_native_readBoolVector(
	size_t parentHandle;		size_t parentHandle;

	const hidl_vec<bool> *vec;		const hidl_vec<bool> *vec;
	status_t err = parcel->readBuffer(&parentHandle,		status_t err = parcel->readBuffer(sizeof(*vec), &parentHandle,
	reinterpret_cast<const void**>(&vec));		reinterpret_cast<const void**>(&vec));

	if (err != OK) {		if (err != OK) {
	@@ -656,7 +656,7 @@ static jbooleanArray JHwParcel_native_readBoolVector(
	size_t childHandle;		size_t childHandle;

	err = ::android::hardware::readEmbeddedFromParcel(		err = ::android::hardware::readEmbeddedFromParcel(
	const_cast<hidl_vec<bool> *>(vec),		const_cast<hidl_vec<bool> &>(*vec),
	*parcel,		*parcel,
	parentHandle,		parentHandle,
	0 /* parentOffset */,		0 /* parentOffset */,
	@@ -709,7 +709,7 @@ static jobjectArray JHwParcel_native_readStringVector(
	size_t parentHandle;		size_t parentHandle;

	const string_vec *vec;		const string_vec *vec;
	status_t err = parcel->readBuffer(&parentHandle,		status_t err = parcel->readBuffer(sizeof(*vec), &parentHandle,
	reinterpret_cast<const void **>(&vec));		reinterpret_cast<const void **>(&vec));

	if (err != OK) {		if (err != OK) {
	@@ -719,16 +719,15 @@ static jobjectArray JHwParcel_native_readStringVector(

	size_t childHandle;		size_t childHandle;
	err = ::android::hardware::readEmbeddedFromParcel(		err = ::android::hardware::readEmbeddedFromParcel(
	const_cast<string_vec *>(vec),		const_cast<string_vec &>(*vec),
	parcel, parentHandle, 0 / parentOffset */, &childHandle);		parcel, parentHandle, 0 / parentOffset */, &childHandle);

	for (size_t i = 0; (err == OK) && (i < vec->size()); ++i) {		for (size_t i = 0; (err == OK) && (i < vec->size()); ++i) {
	err = android::hardware::readEmbeddedFromParcel(		err = android::hardware::readEmbeddedFromParcel(
	const_cast<hidl_vec<hidl_string> *>(vec),		const_cast<hidl_string &>((*vec)[i]),
	*parcel,		*parcel,
	childHandle,		childHandle,
	i * sizeof(hidl_string),		i * sizeof(hidl_string) /* parentOffset */);
	nullptr /* childHandle */);
	}		}

	if (err != OK) {		if (err != OK) {
	@@ -810,13 +809,20 @@ static jobject JHwParcel_native_readStrongBinder(JNIEnv *env, jobject thiz) {
	return JHwRemoteBinder::NewObject(env, binder);		return JHwRemoteBinder::NewObject(env, binder);
	}		}

	static jobject JHwParcel_native_readBuffer(JNIEnv *env, jobject thiz) {		static jobject JHwParcel_native_readBuffer(JNIEnv *env, jobject thiz,
			jlong expectedSize) {
	hardware::Parcel *parcel =		hardware::Parcel *parcel =
	JHwParcel::GetNativeContext(env, thiz)->getParcel();		JHwParcel::GetNativeContext(env, thiz)->getParcel();

	size_t handle;		size_t handle;
	const void *ptr;		const void *ptr;
	status_t status = parcel->readBuffer(&handle, &ptr);
			if (expectedSize < 0) {
			jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
			return nullptr;
			}

			status_t status = parcel->readBuffer(expectedSize, &handle, &ptr);

	if (status != OK) {		if (status != OK) {
	jniThrowException(env, "java/util/NoSuchElementException", NULL);		jniThrowException(env, "java/util/NoSuchElementException", NULL);
	@@ -827,8 +833,8 @@ static jobject JHwParcel_native_readBuffer(JNIEnv *env, jobject thiz) {
	}		}

	static jobject JHwParcel_native_readEmbeddedBuffer(		static jobject JHwParcel_native_readEmbeddedBuffer(
	JNIEnv *env, jobject thiz, jlong parentHandle, jlong offset,		JNIEnv *env, jobject thiz, jlong expectedSize,
	jboolean nullable) {		jlong parentHandle, jlong offset, jboolean nullable) {
	hardware::Parcel *parcel =		hardware::Parcel *parcel =
	JHwParcel::GetNativeContext(env, thiz)->getParcel();		JHwParcel::GetNativeContext(env, thiz)->getParcel();

	@@ -836,8 +842,13 @@ static jobject JHwParcel_native_readEmbeddedBuffer(

	const void *ptr;		const void *ptr;
	status_t status =		status_t status =
	parcel->readNullableEmbeddedBuffer(&childHandle, parentHandle, offset,		parcel->readNullableEmbeddedBuffer(expectedSize,
	&ptr);		&childHandle, parentHandle, offset, &ptr);

			if (expectedSize < 0) {
			jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
			return nullptr;
			}

	if (status != OK) {		if (status != OK) {
	jniThrowException(env, "java/util/NoSuchElementException", NULL);		jniThrowException(env, "java/util/NoSuchElementException", NULL);
	@@ -952,10 +963,10 @@ static JNINativeMethod gMethods[] = {

	{ "send", "()V", (void *)JHwParcel_native_send },		{ "send", "()V", (void *)JHwParcel_native_send },

	{ "readBuffer", "()L" PACKAGE_PATH "/HwBlob;",		{ "readBuffer", "(J)L" PACKAGE_PATH "/HwBlob;",
	(void *)JHwParcel_native_readBuffer },		(void *)JHwParcel_native_readBuffer },

	{ "readEmbeddedBuffer", "(JJZ)L" PACKAGE_PATH "/HwBlob;",		{ "readEmbeddedBuffer", "(JJJZ)L" PACKAGE_PATH "/HwBlob;",
	(void *)JHwParcel_native_readEmbeddedBuffer },		(void *)JHwParcel_native_readEmbeddedBuffer },

	{ "writeBuffer", "(L" PACKAGE_PATH "/HwBlob;)V",		{ "writeBuffer", "(L" PACKAGE_PATH "/HwBlob;)V",