diff options
| author | Seigo Nonaka <nona@google.com> | 2018-07-19 16:22:02 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-08-16 16:02:00 +0000 |
| commit | 54f661b16b308cf38d1b9703214591c0f83df64d (patch) | |
| tree | 2ceb1f27ab1afcc01a43cbdf39e07fba01b8e692 | |
| parent | dbe404dc74c77bfa6c592645db1870d6023d9d3b (diff) | |
| download | base-54f661b16b308cf38d1b9703214591c0f83df64d.tar.gz | |
Fix crash during cursor moving on BiDi text
The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0
The root cause of the crashing is requesting out-of-line access for the
horizontal width. This invalid access is silently ignored by
TextLine#measure() method but new implementation end up with out of
bounds access.
To makes behavior as old implementation, calling getHorizontal instead
of accessing measured result array.
Bug: 78464361, 111580019
Test: Manually done
Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit 960647d582911ae7ab8b9491097898e6c313aaf1)
Merged-In: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit a1076fdaa54ebf56bb32bea43fb278f7470ff307)
| -rw-r--r-- | core/java/android/text/Layout.java | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/core/java/android/text/Layout.java b/core/java/android/text/Layout.java index 09af85db2620..c6f73cb47576 100644 --- a/core/java/android/text/Layout.java +++ b/core/java/android/text/Layout.java @@ -1583,7 +1583,8 @@ public abstract class Layout { } float get(final int offset) { - if (mHorizontals == null) { + if (mHorizontals == null || offset < mLineStartOffset + || offset >= mLineStartOffset + mHorizontals.length) { return getHorizontal(offset, mPrimary); } else { return mHorizontals[offset - mLineStartOffset]; |