Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cdadfc21 authored by Derek Sollenberger's avatar Derek Sollenberger
Browse files

Check that the parcel contained the expected amount of region data.

bug:20883006
Change-Id: Ib47a8ec8696dbc37e958b8dbceb43fcbabf6605b
parent beda8613
Loading
Loading
Loading
Loading
+7 −3
Original line number Diff line number Diff line
@@ -212,10 +212,14 @@ static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

    SkRegion* region = new SkRegion;
    size_t size = p->readInt32();
    size_t actualSize = region->readFromMemory(p->readInplace(size), size);
    const size_t size = p->readInt32();
    const void* regionData = p->readInplace(size);
    if (regionData == nullptr) {
        return 0;
    }

    SkRegion* region = new SkRegion;
    size_t actualSize = region->readFromMemory(regionData, size);
    if (size != actualSize) {
        delete region;
        return 0;