Merge "Fix a crash where user data was not validated."
diff --git a/core/java/android/text/SpannableStringBuilder.java b/core/java/android/text/SpannableStringBuilder.java
index 34274a6..b55cd6a 100644
--- a/core/java/android/text/SpannableStringBuilder.java
+++ b/core/java/android/text/SpannableStringBuilder.java
@@ -29,6 +29,7 @@
*/
public class SpannableStringBuilder implements CharSequence, GetChars, Spannable, Editable,
Appendable, GraphicsOperations {
+ private final static String TAG = "SpannableStringBuilder";
/**
* Create a new SpannableStringBuilder with empty contents
*/
@@ -436,10 +437,26 @@
}
// Documentation from interface
- public SpannableStringBuilder replace(final int start, final int end,
+ public SpannableStringBuilder replace(int start, int end,
CharSequence tb, int tbstart, int tbend) {
checkRange("replace", start, end);
+ // Sanity check
+ if (start > end) {
+ Log.w(TAG, "Bad arguments to #replace : "
+ + "start = " + start + ", end = " + end);
+ final int tmp = start;
+ start = end;
+ end = tmp;
+ }
+ if (tbstart > tbend) {
+ Log.w(TAG, "Bad arguments to #replace : "
+ + "tbstart = " + tbstart + ", tbend = " + tbend);
+ final int tmp = tbstart;
+ tbstart = tbend;
+ tbend = tmp;
+ }
+
int filtercount = mFilters.length;
for (int i = 0; i < filtercount; i++) {
CharSequence repl = mFilters[i].filter(tb, tbstart, tbend, this, start, end);
@@ -613,8 +630,9 @@
// 0-length Spanned.SPAN_EXCLUSIVE_EXCLUSIVE
if (flagsStart == POINT && flagsEnd == MARK && start == end) {
- if (send) Log.e("SpannableStringBuilder",
- "SPAN_EXCLUSIVE_EXCLUSIVE spans cannot have a zero length");
+ if (send) {
+ Log.e(TAG, "SPAN_EXCLUSIVE_EXCLUSIVE spans cannot have a zero length");
+ }
// Silently ignore invalid spans when they are created from this class.
// This avoids the duplication of the above test code before all the
// calls to setSpan that are done in this class
diff --git a/core/java/android/widget/TextView.java b/core/java/android/widget/TextView.java
index 65b79fc..e5cb16f 100644
--- a/core/java/android/widget/TextView.java
+++ b/core/java/android/widget/TextView.java
@@ -5809,6 +5809,7 @@
int end = text.partialEndOffset;
if (end > N) end = N;
removeParcelableSpans(content, start, end);
+ // If start > end, content.replace will swap them before using them.
content.replace(start, end, text.text);
}
}