MotionEvents must check for invalid sample/pointer counts
Bug:23905002
Change-Id: Ibab44754bb49a5ba2dbb15a9bcd5e7d69e923468
diff --git a/tests/tests/view/src/android/view/cts/MotionEventTest.java b/tests/tests/view/src/android/view/cts/MotionEventTest.java
index cdedca4..10ea33a 100644
--- a/tests/tests/view/src/android/view/cts/MotionEventTest.java
+++ b/tests/tests/view/src/android/view/cts/MotionEventTest.java
@@ -180,6 +180,40 @@
assertEquals(mMotionEvent2.getDeviceId(), motionEvent.getDeviceId());
}
+ public void testReadFromParcelWithInvalidPointerCountSize() {
+ Parcel parcel = Parcel.obtain();
+ mMotionEvent2.writeToParcel(parcel, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
+
+ // Move to pointer id count.
+ parcel.setDataPosition(4);
+ parcel.writeInt(17);
+
+ parcel.setDataPosition(0);
+ try {
+ MotionEvent.CREATOR.createFromParcel(parcel);
+ fail("deserialized invalid parcel");
+ } catch (RuntimeException e) {
+ // Expected.
+ }
+ }
+
+ public void testReadFromParcelWithInvalidSampleSize() {
+ Parcel parcel = Parcel.obtain();
+ mMotionEvent2.writeToParcel(parcel, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
+
+ // Move to sample count.
+ parcel.setDataPosition(2 * 4);
+ parcel.writeInt(0x000f0000);
+
+ parcel.setDataPosition(0);
+ try {
+ MotionEvent.CREATOR.createFromParcel(parcel);
+ fail("deserialized invalid parcel");
+ } catch (RuntimeException e) {
+ // Expected.
+ }
+ }
+
public void testToString() {
// make sure this method never throw exception.
mMotionEvent2.toString();