Fix Parcel.writeNative to not ignore 'offset'.
Also switch to using libcore's array bounds checking. (This variant had no
detail message and was missing the length check.)
Bug: http://code.google.com/p/android/issues/detail?id=15075
Change-Id: Icfc045bd59403b59f02d95c8514abf881d3996e5
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
index 31f8719..8944f12 100644
--- a/core/java/android/os/Parcel.java
+++ b/core/java/android/os/Parcel.java
@@ -31,6 +31,7 @@
import java.io.Serializable;
import java.lang.reflect.Field;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -356,7 +357,7 @@
public final native void enforceInterface(String interfaceName);
/**
- * Write a byte array into the parcel at the current {#link #dataPosition},
+ * Write a byte array into the parcel at the current {@link #dataPosition},
* growing {@link #dataCapacity} if needed.
* @param b Bytes to place into the parcel.
*/
@@ -365,7 +366,7 @@
}
/**
- * Write an byte array into the parcel at the current {#link #dataPosition},
+ * Write an byte array into the parcel at the current {@link #dataPosition},
* growing {@link #dataCapacity} if needed.
* @param b Bytes to place into the parcel.
* @param offset Index of first byte to be written.
@@ -376,9 +377,7 @@
writeInt(-1);
return;
}
- if (b.length < offset + len || len < 0 || offset < 0) {
- throw new ArrayIndexOutOfBoundsException();
- }
+ Arrays.checkOffsetAndCount(b.length, offset, len);
writeNative(b, offset, len);
}
diff --git a/core/jni/android_util_Binder.cpp b/core/jni/android_util_Binder.cpp
index 7a53874..c6e56fe 100644
--- a/core/jni/android_util_Binder.cpp
+++ b/core/jni/android_util_Binder.cpp
@@ -1152,15 +1152,13 @@
if (parcel == NULL) {
return;
}
- void *dest;
const status_t err = parcel->writeInt32(length);
if (err != NO_ERROR) {
jniThrowException(env, "java/lang/OutOfMemoryError", NULL);
}
- dest = parcel->writeInplace(length);
-
+ void* dest = parcel->writeInplace(length);
if (dest == NULL) {
jniThrowException(env, "java/lang/OutOfMemoryError", NULL);
return;
@@ -1168,7 +1166,7 @@
jbyte* ar = (jbyte*)env->GetPrimitiveArrayCritical((jarray)data, 0);
if (ar) {
- memcpy(dest, ar, length);
+ memcpy(dest, ar + offset, length);
env->ReleasePrimitiveArrayCritical((jarray)data, ar, 0);
}
}