diff options
| author | Leon Scroggins III <scroggo@google.com> | 2015-05-26 16:41:09 -0400 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-18 18:40:31 +0200 |
| commit | feaf84ab8c466f98d42d5a29b54ac273f9e9afde (patch) | |
| tree | dc6942bcae516222538d5f92c662add23add54f7 /core | |
| parent | f91d33c919c04a22a3d20c4391b88a2a74111700 (diff) | |
| download | frameworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.zip frameworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.tar.gz frameworks_base-feaf84ab8c466f98d42d5a29b54ac273f9e9afde.tar.bz2 | |
Check that the parcel contained the expected amount of region data. DO NOT MERGE
bug:20883006
Change-Id: Ib47a8ec8696dbc37e958b8dbceb43fcbabf6605b
Conflicts:
core/jni/android/graphics/Region.cpp
Diffstat (limited to 'core')
| -rw-r--r-- | core/jni/android/graphics/Region.cpp | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/core/jni/android/graphics/Region.cpp b/core/jni/android/graphics/Region.cpp index 866d223..6ba4de2 100644 --- a/core/jni/android/graphics/Region.cpp +++ b/core/jni/android/graphics/Region.cpp @@ -175,9 +175,13 @@ static SkRegion* Region_createFromParcel(JNIEnv* env, jobject clazz, jobject par android::Parcel* p = android::parcelForJavaObject(env, parcel); + const size_t size = p->readInt32(); + const void* regionData = p->readInplace(size); + if (regionData == NULL) { + return NULL; + } SkRegion* region = new SkRegion; - size_t size = p->readInt32(); - region->unflatten(p->readInplace(size)); + region->unflatten(regionData); return region; } |