Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d82f8a9a authored by Raph Levien's avatar Raph Levien
Browse files

Check bounds on CharSequence drawText methods 

The canvas drawText() methods on CharSequence arguments didn't check
whether the start and end offsets were within bounds, which triggered
native crashes. This patch checks the bounds and throws
IndexOutOfBoundsException when invalid.

Bug: 18282500
Change-Id: I1935bf21f828b960c817b40ebce6affd4ce8bb99
parent 705c9c13

core/java/android/view/GLES20Canvas.java

+3 −0
Original line number Diff line number Diff line
@@ -885,6 +885,9 @@ class GLES20Canvas extends HardwareCanvas { 


    @Override

    public void drawText(CharSequence text, int start, int end, float x, float y, Paint paint) {

        if ((start | end | (end - start) | (text.length() - end)) < 0) {

            throw new IndexOutOfBoundsException();

        }

        if (text instanceof String || text instanceof SpannedString ||

                text instanceof SpannableString) {

            nDrawText(mRenderer, text.toString(), start, end, x, y, paint.mBidiFlags,

graphics/java/android/graphics/Canvas.java

+3 −0
Original line number Diff line number Diff line
@@ -1644,6 +1644,9 @@ public class Canvas { 
     */

    public void drawText(@NonNull CharSequence text, int start, int end, float x, float y,

            @NonNull Paint paint) {

        if ((start | end | (end - start) | (text.length() - end)) < 0) {

            throw new IndexOutOfBoundsException();

        }

        if (text instanceof String || text instanceof SpannedString ||

            text instanceof SpannableString) {

            native_drawText(mNativeCanvasWrapper, text.toString(), start, end, x, y,