Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0c1daa1 authored by Hao Ke's avatar Hao Ke Committed by Android (Google) Code Review
Browse files

Merge "Update Parcel readLazyValue to ignore negative object lengths" into tm-dev

parents 3c8ae9c1 34683275

core/java/android/os/Parcel.java

+3 −0
Original line number Diff line number Diff line
@@ -4388,6 +4388,9 @@ public final class Parcel { 
        int type = readInt();

        if (isLengthPrefixed(type)) {

            int objectLength = readInt();

            if (objectLength < 0) {

                return null;

            }

            int end = MathUtils.addOrThrow(dataPosition(), objectLength);

            int valueLength = end - start;

            setDataPosition(end);