diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
index 5137e1b..aff6ad8 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
@@ -342,7 +342,7 @@
         }
 
         String name = values.getAsString(Settings.Secure.NAME);
-        if (TextUtils.isEmpty(name)) {
+        if (!isKeyValid(name)) {
             return null;
         }
 
@@ -406,11 +406,10 @@
             return 0;
         }
 
-        if (TextUtils.isEmpty(args.name)) {
+        if (!isKeyValid(args.name)) {
             return 0;
         }
 
-
         switch (args.table) {
             case TABLE_GLOBAL: {
                 final int userId = UserHandle.getCallingUserId();
@@ -446,10 +445,11 @@
             return 0;
         }
 
-        String value = values.getAsString(Settings.Secure.VALUE);
-        if (TextUtils.isEmpty(value)) {
+        String name = values.getAsString(Settings.Secure.NAME);
+        if (!isKeyValid(name)) {
             return 0;
         }
+        String value = values.getAsString(Settings.Secure.VALUE);
 
         switch (args.table) {
             case TABLE_GLOBAL: {
@@ -525,13 +525,20 @@
         final int valueColumnIdx = cursor.getColumnIndex(Settings.NameValueTable.VALUE);
 
         do {
-            pw.append("_id:").append(cursor.getString(idColumnIdx));
-            pw.append(" name:").append(cursor.getString(nameColumnIdx));
-            pw.append(" value:").append(cursor.getString(valueColumnIdx));
+            pw.append("_id:").append(toDumpString(cursor.getString(idColumnIdx)));
+            pw.append(" name:").append(toDumpString(cursor.getString(nameColumnIdx)));
+            pw.append(" value:").append(toDumpString(cursor.getString(valueColumnIdx)));
             pw.println();
         } while (cursor.moveToNext());
     }
 
+    private static final String toDumpString(String s) {
+        if (s != null) {
+            return s;
+        }
+        return "{null}";
+    }
+
     private void registerBroadcastReceivers() {
         IntentFilter userFilter = new IntentFilter();
         userFilter.addAction(Intent.ACTION_USER_REMOVED);
@@ -1280,6 +1287,10 @@
         cursor.addRow(values);
     }
 
+    private static boolean isKeyValid(String key) {
+        return !(TextUtils.isEmpty(key) || SettingsState.isBinary(key));
+    }
+
     private static final class Arguments {
         private static final Pattern WHERE_PATTERN_WITH_PARAM_NO_BRACKETS =
                 Pattern.compile("[\\s]*name[\\s]*=[\\s]*\\?[\\s]*");
@@ -1812,7 +1823,7 @@
         }
 
         private final class UpgradeController {
-            private static final int SETTINGS_VERSION = 120;
+            private static final int SETTINGS_VERSION = 121;
 
             private final int mUserId;
 
@@ -1940,6 +1951,10 @@
                     currentVersion = 120;
                 }
 
+                // Before 121, we used a different string encoding logic.  We just bump the version
+                // here; SettingsState knows how to handle pre-version 120 files.
+                currentVersion = 121;
+
                 // vXXX: Add new settings above this point.
 
                 // Return the current version.
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsState.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsState.java
index a2adb15..95d7772 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsState.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsState.java
@@ -23,6 +23,7 @@
 import android.text.TextUtils;
 import android.util.ArrayMap;
 import android.util.AtomicFile;
+import android.util.Base64;
 import android.util.Slog;
 import android.util.Xml;
 import com.android.internal.annotations.GuardedBy;
@@ -59,6 +60,8 @@
 
     private static final String LOG_TAG = "SettingsState";
 
+    static final int SETTINGS_VERSOIN_NEW_ENCODING = 121;
+
     private static final long WRITE_SETTINGS_DELAY_MILLIS = 200;
     private static final long MAX_WRITE_SETTINGS_DELAY_MILLIS = 2000;
 
@@ -76,9 +79,19 @@
     private static final String ATTR_VERSION = "version";
     private static final String ATTR_ID = "id";
     private static final String ATTR_NAME = "name";
+
+    /** Non-binary value will be written in this attribute. */
     private static final String ATTR_VALUE = "value";
 
-    private static final String NULL_VALUE = "null";
+    /**
+     * KXmlSerializer won't like some characters.  We encode such characters in base64 and
+     * store in this attribute.
+     * NOTE: A null value will have NEITHER ATTR_VALUE nor ATTR_VALUE_BASE64.
+     */
+    private static final String ATTR_VALUE_BASE64 = "valueBase64";
+
+    // This was used in version 120 and before.
+    private static final String NULL_VALUE_OLD_STYLE = "null";
 
     private final Object mLock;
 
@@ -364,12 +377,8 @@
             for (int i = 0; i < settingCount; i++) {
                 Setting setting = settings.valueAt(i);
 
-                serializer.startTag(null, TAG_SETTING);
-                serializer.attribute(null, ATTR_ID, setting.getId());
-                serializer.attribute(null, ATTR_NAME, setting.getName());
-                serializer.attribute(null, ATTR_VALUE, packValue(setting.getValue()));
-                serializer.attribute(null, ATTR_PACKAGE, packValue(setting.getPackageName()));
-                serializer.endTag(null, TAG_SETTING);
+                writeSingleSetting(mVersion, serializer, setting.getId(), setting.getName(),
+                        setting.getValue(), setting.getPackageName());
 
                 if (DEBUG_PERSISTENCE) {
                     Slog.i(LOG_TAG, "[PERSISTED]" + setting.getName() + "=" + setting.getValue());
@@ -394,6 +403,64 @@
         }
     }
 
+    static void writeSingleSetting(int version, XmlSerializer serializer, String id,
+            String name, String value, String packageName) throws IOException {
+        if (id == null || isBinary(id) || name == null || isBinary(name)
+                || packageName == null || isBinary(packageName)) {
+            // This shouldn't happen.
+            return;
+        }
+        serializer.startTag(null, TAG_SETTING);
+        serializer.attribute(null, ATTR_ID, id);
+        serializer.attribute(null, ATTR_NAME, name);
+        setValueAttribute(version, serializer, value);
+        serializer.attribute(null, ATTR_PACKAGE, packageName);
+        serializer.endTag(null, TAG_SETTING);
+    }
+
+    static void setValueAttribute(int version, XmlSerializer serializer, String value)
+            throws IOException {
+        if (version >= SETTINGS_VERSOIN_NEW_ENCODING) {
+            if (value == null) {
+                // Null value -> No ATTR_VALUE nor ATTR_VALUE_BASE64.
+            } else if (isBinary(value)) {
+                serializer.attribute(null, ATTR_VALUE_BASE64, base64Encode(value));
+            } else {
+                serializer.attribute(null, ATTR_VALUE, value);
+            }
+        } else {
+            // Old encoding.
+            if (value == null) {
+                serializer.attribute(null, ATTR_VALUE, NULL_VALUE_OLD_STYLE);
+            } else {
+                serializer.attribute(null, ATTR_VALUE, value);
+            }
+        }
+    }
+
+    private String getValueAttribute(XmlPullParser parser) {
+        if (mVersion >= SETTINGS_VERSOIN_NEW_ENCODING) {
+            final String value = parser.getAttributeValue(null, ATTR_VALUE);
+            if (value != null) {
+                return value;
+            }
+            final String base64 = parser.getAttributeValue(null, ATTR_VALUE_BASE64);
+            if (base64 != null) {
+                return base64Decode(base64);
+            }
+            // null has neither ATTR_VALUE nor ATTR_VALUE_BASE64.
+            return null;
+        } else {
+            // Old encoding.
+            final String stored = parser.getAttributeValue(null, ATTR_VALUE);
+            if (NULL_VALUE_OLD_STYLE.equals(stored)) {
+                return null;
+            } else {
+                return stored;
+            }
+        }
+    }
+
     private void readStateSyncLocked() {
         FileInputStream in;
         if (!mStatePersistFile.exists()) {
@@ -452,10 +519,9 @@
             if (tagName.equals(TAG_SETTING)) {
                 String id = parser.getAttributeValue(null, ATTR_ID);
                 String name = parser.getAttributeValue(null, ATTR_NAME);
-                String value = parser.getAttributeValue(null, ATTR_VALUE);
+                String value = getValueAttribute(parser);
                 String packageName = parser.getAttributeValue(null, ATTR_PACKAGE);
-                mSettings.put(name, new Setting(name, unpackValue(value),
-                        unpackValue(packageName), id));
+                mSettings.put(name, new Setting(name, value, packageName, id));
 
                 if (DEBUG_PERSISTENCE) {
                     Slog.i(LOG_TAG, "[RESTORED] " + name + "=" + value);
@@ -486,20 +552,6 @@
         }
     }
 
-    private static String packValue(String value) {
-        if (value == null) {
-            return NULL_VALUE;
-        }
-        return value;
-    }
-
-    private static String unpackValue(String value) {
-        if (NULL_VALUE.equals(value)) {
-            return null;
-        }
-        return value;
-    }
-
     public final class Setting {
         private String name;
         private String value;
@@ -548,4 +600,58 @@
             return true;
         }
     }
+
+    /**
+     * @return TRUE if a string is considered "binary" from KXML's point of view.  NOTE DO NOT
+     * pass null.
+     */
+    public static boolean isBinary(String s) {
+        if (s == null) {
+            throw new NullPointerException();
+        }
+        // See KXmlSerializer.writeEscaped
+        for (int i = 0; i < s.length(); i++) {
+            char c = s.charAt(i);
+            boolean allowedInXml = (c >= 0x20 && c <= 0xd7ff) || (c >= 0xe000 && c <= 0xfffd);
+            if (!allowedInXml) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static String base64Encode(String s) {
+        return Base64.encodeToString(toBytes(s), Base64.NO_WRAP);
+    }
+
+    private static String base64Decode(String s) {
+        return fromBytes(Base64.decode(s, Base64.DEFAULT));
+    }
+
+    // Note the followings are basically just UTF-16 encode/decode.  But we want to preserve
+    // contents as-is, even if it contains broken surrogate pairs, we do it by ourselves,
+    // since I don't know how Charset would treat them.
+
+    private static byte[] toBytes(String s) {
+        final byte[] result = new byte[s.length() * 2];
+        int resultIndex = 0;
+        for (int i = 0; i < s.length(); ++i) {
+            char ch = s.charAt(i);
+            result[resultIndex++] = (byte) (ch >> 8);
+            result[resultIndex++] = (byte) ch;
+        }
+        return result;
+    }
+
+    private static String fromBytes(byte[] bytes) {
+        final StringBuffer sb = new StringBuffer(bytes.length / 2);
+
+        final int last = bytes.length - 1;
+
+        for (int i = 0; i < last; i += 2) {
+            final char ch = (char) ((bytes[i] & 0xff) << 8 | (bytes[i + 1] & 0xff));
+            sb.append(ch);
+        }
+        return sb.toString();
+    }
 }
diff --git a/packages/SettingsProvider/test/Android.mk b/packages/SettingsProvider/test/Android.mk
index 01c6ccf..ef863e7 100644
--- a/packages/SettingsProvider/test/Android.mk
+++ b/packages/SettingsProvider/test/Android.mk
@@ -2,7 +2,10 @@
 
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES := $(call all-subdir-java-files)
+# Note we statically link SettingsState to do some unit tests.  It's not accessible otherwise
+# because this test is not an instrumentation test. (because the target runs in the system process.)
+LOCAL_SRC_FILES := $(call all-subdir-java-files) \
+    ../src/com/android/providers/settings/SettingsState.java
 
 LOCAL_PACKAGE_NAME := SettingsProviderTest
 
diff --git a/packages/SettingsProvider/test/src/com/android/providers/settings/BaseSettingsProviderTest.java b/packages/SettingsProvider/test/src/com/android/providers/settings/BaseSettingsProviderTest.java
index 8473db4..c7cc89b 100644
--- a/packages/SettingsProvider/test/src/com/android/providers/settings/BaseSettingsProviderTest.java
+++ b/packages/SettingsProvider/test/src/com/android/providers/settings/BaseSettingsProviderTest.java
@@ -39,8 +39,10 @@
 
     protected static final String FAKE_SETTING_NAME = "fake_setting_name";
     protected static final String FAKE_SETTING_NAME_1 = "fake_setting_name1";
+    protected static final String FAKE_SETTING_NAME_2 = "fake_setting_name2";
     protected static final String FAKE_SETTING_VALUE = "fake_setting_value";
-    protected static final String FAKE_SETTING_VALUE_1 = "fake_setting_value_1";
+    protected static final String FAKE_SETTING_VALUE_1 = SettingsStateTest.CRAZY_STRING;
+    protected static final String FAKE_SETTING_VALUE_2 = null;
 
     private static final String[] NAME_VALUE_COLUMNS = new String[] {
             Settings.NameValueTable.NAME, Settings.NameValueTable.VALUE
diff --git a/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsProviderTest.java b/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsProviderTest.java
index b89fb10..ad56b9d 100644
--- a/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsProviderTest.java
+++ b/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsProviderTest.java
@@ -230,10 +230,11 @@
         // Make sure we have a clean slate.
         deleteStringViaProviderApi(type, FAKE_SETTING_NAME);
         deleteStringViaProviderApi(type, FAKE_SETTING_NAME_1);
+        deleteStringViaProviderApi(type, FAKE_SETTING_NAME_2);
 
         try {
             Uri uri = getBaseUriForType(type);
-            ContentValues[] allValues = new ContentValues[2];
+            ContentValues[] allValues = new ContentValues[3];
 
             // Insert the first setting.
             ContentValues firstValues = new ContentValues();
@@ -241,15 +242,21 @@
             firstValues.put(Settings.NameValueTable.VALUE, FAKE_SETTING_VALUE);
             allValues[0] = firstValues;
 
-            // Insert the first setting.
+            // Insert the second setting.
             ContentValues secondValues = new ContentValues();
             secondValues.put(Settings.NameValueTable.NAME, FAKE_SETTING_NAME_1);
             secondValues.put(Settings.NameValueTable.VALUE, FAKE_SETTING_VALUE_1);
             allValues[1] = secondValues;
 
+            // Insert the third setting. (null)
+            ContentValues thirdValues = new ContentValues();
+            thirdValues.put(Settings.NameValueTable.NAME, FAKE_SETTING_NAME_2);
+            thirdValues.put(Settings.NameValueTable.VALUE, FAKE_SETTING_VALUE_2);
+            allValues[2] = thirdValues;
+
             // Verify insertion count.
             final int insertCount = getContext().getContentResolver().bulkInsert(uri, allValues);
-            assertSame("Couldn't insert both values", 2, insertCount);
+            assertSame("Couldn't insert both values", 3, insertCount);
 
             // Make sure the first setting is there.
             String firstValue = queryStringViaProviderApi(type, FAKE_SETTING_NAME);
@@ -258,10 +265,15 @@
             // Make sure the second setting is there.
             String secondValue = queryStringViaProviderApi(type, FAKE_SETTING_NAME_1);
             assertEquals("Second setting must be present", FAKE_SETTING_VALUE_1, secondValue);
+
+            // Make sure the third setting is there.
+            String thirdValue = queryStringViaProviderApi(type, FAKE_SETTING_NAME_2);
+            assertEquals("Third setting must be present", FAKE_SETTING_VALUE_2, thirdValue);
         } finally {
             // Clean up.
             deleteStringViaProviderApi(type, FAKE_SETTING_NAME);
             deleteStringViaProviderApi(type, FAKE_SETTING_NAME_1);
+            deleteStringViaProviderApi(type, FAKE_SETTING_NAME_2);
         }
     }
 
diff --git a/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsStateTest.java b/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsStateTest.java
new file mode 100644
index 0000000..3f9ffa1
--- /dev/null
+++ b/packages/SettingsProvider/test/src/com/android/providers/settings/SettingsStateTest.java
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.providers.settings;
+
+import android.test.AndroidTestCase;
+import android.util.Xml;
+
+import org.xmlpull.v1.XmlSerializer;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+
+public class SettingsStateTest extends AndroidTestCase {
+    public static final String CRAZY_STRING =
+            "\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u0009\n\u000b\u000c\r" +
+            "\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a" +
+            "\u001b\u001c\u001d\u001e\u001f\u0020" +
+            "fake_setting_value_1" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +
+            "\u1000 \u2000 \u5000 \u8000 \uc000 \ue000" +
+            "\ud800\udc00\udbff\udfff" + // surrogate pairs
+            "\uD800ab\uDC00 " + // broken surrogate pairs
+            "日本語";
+
+
+    public void testIsBinary() {
+        assertFalse(SettingsState.isBinary(" abc 日本語"));
+
+        for (char ch = 0x20; ch < 0xd800; ch++) {
+            assertFalse("ch=" + Integer.toString(ch, 16),
+                    SettingsState.isBinary(String.valueOf(ch)));
+        }
+        for (char ch = 0xe000; ch < 0xfffe; ch++) {
+            assertFalse("ch=" + Integer.toString(ch, 16),
+                    SettingsState.isBinary(String.valueOf(ch)));
+        }
+
+        for (char ch = 0x0000; ch < 0x20; ch++) {
+            assertTrue("ch=" + Integer.toString(ch, 16),
+                    SettingsState.isBinary(String.valueOf(ch)));
+        }
+        for (char ch = 0xd800; ch < 0xe000; ch++) {
+            assertTrue("ch=" + Integer.toString(ch, 16),
+                    SettingsState.isBinary(String.valueOf(ch)));
+        }
+        assertTrue(SettingsState.isBinary("\ufffe"));
+        assertTrue(SettingsState.isBinary("\uffff"));
+        try {
+            assertFalse(SettingsState.isBinary(null));
+            fail("NullPointerException expected");
+        } catch (NullPointerException expected) {
+        }
+    }
+
+    /** Make sure we won't pass invalid characters to XML serializer. */
+    public void testWriteReadNoCrash() throws Exception {
+        ByteArrayOutputStream os = new ByteArrayOutputStream();
+
+        XmlSerializer serializer = Xml.newSerializer();
+        serializer.setOutput(os, StandardCharsets.UTF_8.name());
+        serializer.setFeature("http://xmlpull.org/v1/doc/features.html#indent-output", true);
+        serializer.startDocument(null, true);
+
+        for (int ch = 0; ch < 0x10000; ch++) {
+            checkWriteSingleSetting("char=0x" + Integer.toString(ch, 16), serializer,
+                    "key", String.valueOf((char) ch));
+        }
+        checkWriteSingleSetting(serializer, "k", "");
+        checkWriteSingleSetting(serializer, "x", "abc");
+        checkWriteSingleSetting(serializer, "abc", CRAZY_STRING);
+        checkWriteSingleSetting(serializer, "def", null);
+
+        // Invlid input, but shouoldn't crash.
+        checkWriteSingleSetting(serializer, null, null);
+        checkWriteSingleSetting(serializer, CRAZY_STRING, null);
+        SettingsState.writeSingleSetting(
+                SettingsState.SETTINGS_VERSOIN_NEW_ENCODING,
+                serializer, null, "k", "v", "package");
+        SettingsState.writeSingleSetting(
+                SettingsState.SETTINGS_VERSOIN_NEW_ENCODING,
+                serializer, "1", "k", "v", null);
+    }
+
+    private void checkWriteSingleSetting(XmlSerializer serializer, String key, String value)
+            throws Exception {
+        checkWriteSingleSetting(key + "/" + value, serializer, key, value);
+    }
+
+    private void checkWriteSingleSetting(String msg, XmlSerializer serializer,
+            String key, String value) throws Exception {
+        // Make sure the XML serializer won't crash.
+        SettingsState.writeSingleSetting(
+                SettingsState.SETTINGS_VERSOIN_NEW_ENCODING,
+                serializer, "1", key, value, "package");
+    }
+
+    /**
+     * Make sure settings can be written to a file and also can be read.
+     */
+    public void testReadWrite() {
+        final File file = new File(getContext().getCacheDir(), "setting.xml");
+        file.delete();
+        final Object lock = new Object();
+
+        final SettingsState ssWriter = new SettingsState(lock, file, 1,
+                SettingsState.MAX_BYTES_PER_APP_PACKAGE_UNLIMITED);
+        ssWriter.setVersionLocked(SettingsState.SETTINGS_VERSOIN_NEW_ENCODING);
+
+        ssWriter.insertSettingLocked("k1", "\u0000", "package");
+        ssWriter.insertSettingLocked("k2", "abc", "p2");
+        ssWriter.insertSettingLocked("k3", null, "p2");
+        ssWriter.insertSettingLocked("k4", CRAZY_STRING, "p3");
+        synchronized (lock) {
+            ssWriter.persistSyncLocked();
+        }
+
+        final SettingsState ssReader = new SettingsState(lock, file, 1,
+                SettingsState.MAX_BYTES_PER_APP_PACKAGE_UNLIMITED);
+        synchronized (lock) {
+            assertEquals("\u0000", ssReader.getSettingLocked("k1").getValue());
+            assertEquals("abc", ssReader.getSettingLocked("k2").getValue());
+            assertEquals(null, ssReader.getSettingLocked("k3").getValue());
+            assertEquals(CRAZY_STRING, ssReader.getSettingLocked("k4").getValue());
+        }
+    }
+
+    /**
+     * In version 120, value "null" meant {code NULL}.
+     */
+    public void testUpgrade() throws Exception {
+        final File file = new File(getContext().getCacheDir(), "setting.xml");
+        file.delete();
+        final Object lock = new Object();
+        final PrintStream os = new PrintStream(new FileOutputStream(file));
+        os.print(
+                "<?xml version='1.0' encoding='UTF-8' standalone='yes' ?>" +
+                "<settings version=\"120\">" +
+                "  <setting id=\"0\" name=\"k0\" value=\"null\" package=\"null\" />" +
+                "  <setting id=\"1\" name=\"k1\" value=\"\" package=\"\" />" +
+                "  <setting id=\"2\" name=\"k2\" value=\"v2\" package=\"p2\" />" +
+                "</settings>");
+        os.close();
+
+        final SettingsState ss = new SettingsState(lock, file, 1,
+                SettingsState.MAX_BYTES_PER_APP_PACKAGE_UNLIMITED);
+        synchronized (lock) {
+            SettingsState.Setting s;
+            s = ss.getSettingLocked("k0");
+            assertEquals(null, s.getValue());
+            assertEquals("null", s.getPackageName());
+
+            s = ss.getSettingLocked("k1");
+            assertEquals("", s.getValue());
+            assertEquals("", s.getPackageName());
+
+            s = ss.getSettingLocked("k2");
+            assertEquals("v2", s.getValue());
+            assertEquals("p2", s.getPackageName());
+        }
+    }
+}