Fix for bug 2672749: StringIndexOutOfBoundsException in Uri.getQueryParameter

Change-Id: I10b02306478d9c595dbcae0767b44c403d50e24a

2 files changed, 23 insertions, 0 deletions

diff --git a/core/java/android/net/Uri.java b/core/java/android/net/Uri.java
index eca4569..47faaba 100644
--- a/core/java/android/net/Uri.java
+++ b/core/java/android/net/Uri.java
@@ -1588,6 +1588,9 @@ public abstract class Uri implements Parcelable, Comparable<Uri> {
                 break;
             }
             final int equalsIndex = keyIndex + encodedKeyLength;
+            if (equalsIndex >= query.length()) {
+                break;
+            }
             if (query.charAt(equalsIndex) != '=') {
                 encodedKeySearchIndex = equalsIndex + 1;
                 continue;
diff --git a/core/tests/coretests/src/android/net/UriTest.java b/core/tests/coretests/src/android/net/UriTest.java
index 095ee13..a5fda20 100644
--- a/core/tests/coretests/src/android/net/UriTest.java
+++ b/core/tests/coretests/src/android/net/UriTest.java
@@ -582,5 +582,25 @@ public class UriTest extends TestCase {
             .appendQueryParameter("bkey", "e f")
             .build();
         assertNull(uri.getQueryParameter("key"));
+
+        // key is a prefix or suffix of the query
+        uri = Uri.parse("http://test/?qq=foo");
+        assertNull(uri.getQueryParameter("q"));
+        assertNull(uri.getQueryParameter("oo"));
+
+        // escaped keys
+        uri = Uri.parse("http://www.google.com/?a%20b=foo&c%20d=");
+        assertEquals("foo", uri.getQueryParameter("a b"));
+        assertEquals("", uri.getQueryParameter("c d"));
+        assertNull(uri.getQueryParameter("e f"));
+        assertNull(uri.getQueryParameter("b"));
+        assertNull(uri.getQueryParameter("c"));
+        assertNull(uri.getQueryParameter(" d"));
+
+        // empty values
+        uri = Uri.parse("http://www.google.com/?a=&b=&&c=");
+        assertEquals("", uri.getQueryParameter("a"));
+        assertEquals("", uri.getQueryParameter("b"));
+        assertEquals("", uri.getQueryParameter("c"));
     }
 }