summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLeon Scroggins III <scroggo@google.com>2015-05-26 16:41:09 -0400
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-10-18 18:40:31 +0200
commitfeaf84ab8c466f98d42d5a29b54ac273f9e9afde (patch)
treedc6942bcae516222538d5f92c662add23add54f7
parentf91d33c919c04a22a3d20c4391b88a2a74111700 (diff)
downloadframeworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.zip
frameworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.tar.gz
frameworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.tar.bz2
Check that the parcel contained the expected amount of region data. DO NOT MERGE
bug:20883006 Change-Id: Ib47a8ec8696dbc37e958b8dbceb43fcbabf6605b Conflicts: core/jni/android/graphics/Region.cpp
-rw-r--r--core/jni/android/graphics/Region.cpp8
1 files changed, 6 insertions, 2 deletions
diff --git a/core/jni/android/graphics/Region.cpp b/core/jni/android/graphics/Region.cpp
index 866d223..6ba4de2 100644
--- a/core/jni/android/graphics/Region.cpp
+++ b/core/jni/android/graphics/Region.cpp
@@ -175,9 +175,13 @@ static SkRegion* Region_createFromParcel(JNIEnv* env, jobject clazz, jobject par
android::Parcel* p = android::parcelForJavaObject(env, parcel);
+ const size_t size = p->readInt32();
+ const void* regionData = p->readInplace(size);
+ if (regionData == NULL) {
+ return NULL;
+ }
SkRegion* region = new SkRegion;
- size_t size = p->readInt32();
- region->unflatten(p->readInplace(size));
+ region->unflatten(regionData);
return region;
}