From d82f8a9a3869448e6d7d4b3fc962e34e33a1ba0e Mon Sep 17 00:00:00 2001 From: Raph Levien Date: Wed, 12 Nov 2014 15:05:16 -0800 Subject: Check bounds on CharSequence drawText methods The canvas drawText() methods on CharSequence arguments didn't check whether the start and end offsets were within bounds, which triggered native crashes. This patch checks the bounds and throws IndexOutOfBoundsException when invalid. Bug: 18282500 Change-Id: I1935bf21f828b960c817b40ebce6affd4ce8bb99 --- graphics/java/android/graphics/Canvas.java | 3 +++ 1 file changed, 3 insertions(+) (limited to 'graphics/java') diff --git a/graphics/java/android/graphics/Canvas.java b/graphics/java/android/graphics/Canvas.java index f45c0cb..32b0950 100644 --- a/graphics/java/android/graphics/Canvas.java +++ b/graphics/java/android/graphics/Canvas.java @@ -1644,6 +1644,9 @@ public class Canvas { */ public void drawText(@NonNull CharSequence text, int start, int end, float x, float y, @NonNull Paint paint) { + if ((start | end | (end - start) | (text.length() - end)) < 0) { + throw new IndexOutOfBoundsException(); + } if (text instanceof String || text instanceof SpannedString || text instanceof SpannableString) { native_drawText(mNativeCanvasWrapper, text.toString(), start, end, x, y, -- cgit v1.1