Fix infinite recursion in hashcode of Spannables
An app created a SpannableStringBuilder, one of which's spans was the
instance of the string builder itself (that is, the builder contained a span
that was the builder). This caused infinite recursion in the hashcode()
method because it computes a hash from its fields, including all of its spans.
The fix detects the case where a span equals the current instance and
noops the computation on that span. A similar adjustment was made to equals()
to avoid the same recursion problem.
Issue #11051658 StackOverflowError in android.text.SpannableStringBuilder.hashCode
Change-Id: I742687ab32d81ac51c4b9135f698cf5e96a1d295
diff --git a/core/java/android/text/SpannableStringBuilder.java b/core/java/android/text/SpannableStringBuilder.java
index 6efde05..34274a6 100644
--- a/core/java/android/text/SpannableStringBuilder.java
+++ b/core/java/android/text/SpannableStringBuilder.java
@@ -1293,23 +1293,29 @@
public boolean equals(Object o) {
if (o instanceof Spanned &&
toString().equals(o.toString())) {
+ Spanned other = (Spanned) o;
// Check span data
- Object[] otherSpans = ((Spanned) o).getSpans(0,
- ((Spanned) o).length(), Object.class);
+ Object[] otherSpans = other.getSpans(0, other.length(), Object.class);
if (mSpanCount == otherSpans.length) {
for (int i = 0; i < mSpanCount; ++i) {
Object thisSpan = mSpans[i];
Object otherSpan = otherSpans[i];
- if (!thisSpan.equals(otherSpan) ||
- getSpanStart(thisSpan) != getSpanStart(otherSpan) ||
- getSpanEnd(thisSpan) != getSpanEnd(otherSpan) ||
- getSpanFlags(thisSpan) != getSpanFlags(otherSpan)) {
+ if (thisSpan == this) {
+ if (other != otherSpan ||
+ getSpanStart(thisSpan) != other.getSpanStart(otherSpan) ||
+ getSpanEnd(thisSpan) != other.getSpanEnd(otherSpan) ||
+ getSpanFlags(thisSpan) != other.getSpanFlags(otherSpan)) {
+ return false;
+ }
+ } else if (!thisSpan.equals(otherSpan) ||
+ getSpanStart(thisSpan) != other.getSpanStart(otherSpan) ||
+ getSpanEnd(thisSpan) != other.getSpanEnd(otherSpan) ||
+ getSpanFlags(thisSpan) != other.getSpanFlags(otherSpan)) {
return false;
}
}
return true;
}
-
}
return false;
}
@@ -1321,7 +1327,9 @@
hash = hash * 31 + mSpanCount;
for (int i = 0; i < mSpanCount; ++i) {
Object span = mSpans[i];
- hash = hash * 31 + span.hashCode();
+ if (span != this) {
+ hash = hash * 31 + span.hashCode();
+ }
hash = hash * 31 + getSpanStart(span);
hash = hash * 31 + getSpanEnd(span);
hash = hash * 31 + getSpanFlags(span);