Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a730ef3f authored by Leon Scroggins III's avatar Leon Scroggins III Committed by Leon Scroggins
Browse files

Handle bad ninepatch data. 

Changes proposed by Ben Hawkes of Google Project Zero.

NinePatchPeeker.cpp:
Instead of asserting, return false for bad data.

ResourceTypes.h:
Store ninepatch values as unsigned.

BUG:19151999
Change-Id: Ibe35e7569f632c6bb8a34a7701e26bb6ed547ec2
parent aa6945ac

core/jni/android/graphics/NinePatchPeeker.cpp

+3 −1
Original line number Diff line number Diff line
@@ -24,7 +24,9 @@ bool NinePatchPeeker::peek(const char tag[], const void* data, size_t length) { 
    if (!strcmp("npTc", tag) && length >= sizeof(Res_png_9patch)) {

        Res_png_9patch* patch = (Res_png_9patch*) data;

        size_t patchSize = patch->serializedSize();

        assert(length == patchSize);

        if (length != patchSize) {

            return false;

        }

        // You have to copy the data because it is owned by the png reader

        Res_png_9patch* patchNew = (Res_png_9patch*) malloc(patchSize);

        memcpy(patchNew, patch, patchSize);

include/androidfw/ResourceTypes.h

+3 −3
Original line number Diff line number Diff line
@@ -118,9 +118,9 @@ struct Res_png_9patch 
                       yDivsOffset(0), colorsOffset(0) { }



    int8_t wasDeserialized;

    int8_t numXDivs;

    int8_t numYDivs;

    int8_t numColors;

    uint8_t numXDivs;

    uint8_t numYDivs;

    uint8_t numColors;



    // The offset (from the start of this structure) to the xDivs & yDivs

    // array for this 9patch. To get a pointer to this array, call