提交: 1e72dc7a3074cd0b44d89afbf39bbf5000ef7cc3 - frameworks-base (git)

frameworks/base

Commit MetaInfo

• 修订版: 1e72dc7a3074cd0b44d89afbf39bbf5000ef7cc3 (tree)
• 时间: 2015-08-14 11:41:42
• 作者: Leon Scroggins III <scroggo@goog...>
• Commiter: The Android Automerger

Log Message

DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes

bug: 20883006
Change-Id: I4f109667fb210a80fbddddf5f1bfb7ef3a02b6ce

更改概述

• modified: core/jni/android/graphics/Region.cpp

差异

--- a/core/jni/android/graphics/Region.cpp
+++ b/core/jni/android/graphics/Region.cpp
@@ -218,7 +218,12 @@ static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
         return NULL;
     }
     SkRegion* region = new SkRegion;
-    region->readFromMemory(regionData, size);
+    size_t actualSize = region->readFromMemory(regionData, size);
+
+    if (size != actualSize) {
+        delete region;
+        return NULL;
+    }
 
     return reinterpret_cast<jlong>(region);
 }