diff options
author | Phil Weaver <pweaver@google.com> | 2017-04-06 17:40:51 -0700 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2017-05-25 17:58:38 +0000 |
commit | 4d0c0b29872e0bfb5a3e8ab55b118c760c9a572f (patch) | |
tree | 369a35ef34fdcfed3e4335443b84696dd70081d5 | |
parent | 894d63476f7ea70a5c807add125765d7c82cb0e5 (diff) | |
download | base-4d0c0b29872e0bfb5a3e8ab55b118c760c9a572f.tar.gz |
Make a11y node info parceling more robust
Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.
Bug: 36491278
Test: Verified that POC no longer works, a11y cts still passes.
Change-Id: I10f24747e3ab87d77cd1deba56db4526e3aa5441
(cherry picked from commit 687bb44b437f7bb24dd3dddf072c2f646308e2ca)
(cherry picked from commit 475719d03d9199433edfccb0e1e0e456552e59d7)
-rw-r--r-- | core/java/android/view/accessibility/AccessibilityNodeInfo.java | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/core/java/android/view/accessibility/AccessibilityNodeInfo.java b/core/java/android/view/accessibility/AccessibilityNodeInfo.java index c1076e7b1cec..8463a1aa571f 100644 --- a/core/java/android/view/accessibility/AccessibilityNodeInfo.java +++ b/core/java/android/view/accessibility/AccessibilityNodeInfo.java @@ -2760,16 +2760,19 @@ public class AccessibilityNodeInfo implements Parcelable { if (mActions != null && !mActions.isEmpty()) { final int actionCount = mActions.size(); - parcel.writeInt(actionCount); + int nonLegacyActionCount = 0; int defaultLegacyStandardActions = 0; for (int i = 0; i < actionCount; i++) { AccessibilityAction action = mActions.get(i); if (isDefaultLegacyStandardAction(action)) { defaultLegacyStandardActions |= action.getId(); + } else { + nonLegacyActionCount++; } } parcel.writeInt(defaultLegacyStandardActions); + parcel.writeInt(nonLegacyActionCount); for (int i = 0; i < actionCount; i++) { AccessibilityAction action = mActions.get(i); @@ -2780,6 +2783,7 @@ public class AccessibilityNodeInfo implements Parcelable { } } else { parcel.writeInt(0); + parcel.writeInt(0); } parcel.writeInt(mMaxTextLength); @@ -2947,16 +2951,13 @@ public class AccessibilityNodeInfo implements Parcelable { mBoundsInScreen.left = parcel.readInt(); mBoundsInScreen.right = parcel.readInt(); - final int actionCount = parcel.readInt(); - if (actionCount > 0) { - final int legacyStandardActions = parcel.readInt(); - addLegacyStandardActions(legacyStandardActions); - final int nonLegacyActionCount = actionCount - Integer.bitCount(legacyStandardActions); - for (int i = 0; i < nonLegacyActionCount; i++) { - final AccessibilityAction action = new AccessibilityAction( - parcel.readInt(), parcel.readCharSequence()); - addActionUnchecked(action); - } + final int legacyStandardActions = parcel.readInt(); + addLegacyStandardActions(legacyStandardActions); + final int nonLegacyActionCount = parcel.readInt(); + for (int i = 0; i < nonLegacyActionCount; i++) { + final AccessibilityAction action = new AccessibilityAction( + parcel.readInt(), parcel.readCharSequence()); + addActionUnchecked(action); } mMaxTextLength = parcel.readInt(); |