Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a28b83ee authored by Elliott Hughes's avatar Elliott Hughes
Browse files

Fix Parcel.writeNative to not ignore 'offset'. 

Also switch to using libcore's array bounds checking. (This variant had no
detail message and was missing the length check.)

Bug: http://code.google.com/p/android/issues/detail?id=15075
Change-Id: Icfc045bd59403b59f02d95c8514abf881d3996e5
parent 77194363

core/java/android/os/Parcel.java

+4 −5
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ import java.io.ObjectOutputStream; 
import java.io.Serializable;

import java.lang.reflect.Field;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.HashMap;

import java.util.List;

import java.util.Map;
@@ -356,7 +357,7 @@ public final class Parcel { 
    public final native void enforceInterface(String interfaceName);



    /**

     * Write a byte array into the parcel at the current {#link #dataPosition},

     * Write a byte array into the parcel at the current {@link #dataPosition},

     * growing {@link #dataCapacity} if needed.

     * @param b Bytes to place into the parcel.

     */
@@ -365,7 +366,7 @@ public final class Parcel { 
    }



    /**

     * Write an byte array into the parcel at the current {#link #dataPosition},

     * Write an byte array into the parcel at the current {@link #dataPosition},

     * growing {@link #dataCapacity} if needed.

     * @param b Bytes to place into the parcel.

     * @param offset Index of first byte to be written.
@@ -376,9 +377,7 @@ public final class Parcel { 
            writeInt(-1);

            return;

        }

        if (b.length < offset + len || len < 0 || offset < 0) {

            throw new ArrayIndexOutOfBoundsException();

        }

        Arrays.checkOffsetAndCount(b.length, offset, len);

        writeNative(b, offset, len);

    }

core/jni/android_util_Binder.cpp

+2 −4
Original line number Diff line number Diff line
@@ -1152,15 +1152,13 @@ static void android_os_Parcel_writeNative(JNIEnv* env, jobject clazz, 
    if (parcel == NULL) {

        return;

    }

    void *dest;



    const status_t err = parcel->writeInt32(length);

    if (err != NO_ERROR) {

        jniThrowException(env, "java/lang/OutOfMemoryError", NULL);

    }



    dest = parcel->writeInplace(length);



    void* dest = parcel->writeInplace(length);

    if (dest == NULL) {

        jniThrowException(env, "java/lang/OutOfMemoryError", NULL);

        return;
@@ -1168,7 +1166,7 @@ static void android_os_Parcel_writeNative(JNIEnv* env, jobject clazz, 


    jbyte* ar = (jbyte*)env->GetPrimitiveArrayCritical((jarray)data, 0);

    if (ar) {

        memcpy(dest, ar, length);

        memcpy(dest, ar + offset, length);

        env->ReleasePrimitiveArrayCritical((jarray)data, ar, 0);

    }

}