Merge "Ensure that unparcelling Region only reads the expected number of bytes" into mnc-dev
diff --git a/core/jni/android/graphics/Region.cpp b/core/jni/android/graphics/Region.cpp
index 90a020e..cf02e39 100644
--- a/core/jni/android/graphics/Region.cpp
+++ b/core/jni/android/graphics/Region.cpp
@@ -206,15 +206,20 @@
static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
{
- if (parcel == NULL) {
- return NULL;
+ if (parcel == nullptr) {
+ return 0;
}
android::Parcel* p = android::parcelForJavaObject(env, parcel);
SkRegion* region = new SkRegion;
size_t size = p->readInt32();
- region->readFromMemory(p->readInplace(size), size);
+ size_t actualSize = region->readFromMemory(p->readInplace(size), size);
+
+ if (size != actualSize) {
+ delete region;
+ return 0;
+ }
return reinterpret_cast<jlong>(region);
}