From f0fc52b59be0bf39912f7b698d9bde26415a6096 Mon Sep 17 00:00:00 2001
From: Christopher Wiley <wiley@google.com>
Date: Sat, 31 Oct 2015 13:22:15 -0700
Subject: Fix bug in byte vector serialization

Byte vectors are used by the generated C++ code as the representation
of Java byte[].  This type is serialized as a packed byte array on
the java side.

Bug: 25012838
Test: integration tests for byte[] show this type crossing language
      boundaries correctly.

Change-Id: I8bb1b8ffcb77ced44f99f6b370226a32694f7df1
---
 libs/binder/Parcel.cpp | 42 ++++++++++++++++++++----------------------
 1 file changed, 20 insertions(+), 22 deletions(-)

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index ab2cdab215..694916cf10 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -719,25 +719,25 @@ restart_write:
 
 status_t Parcel::writeByteVector(const std::vector<int8_t>& val)
 {
+    status_t status;
     if (val.size() > std::numeric_limits<int32_t>::max()) {
-        return BAD_VALUE;
+        status = BAD_VALUE;
+        return status;
     }
 
-    status_t status = writeInt32(val.size());
-
+    status = writeInt32(val.size());
     if (status != OK) {
         return status;
     }
 
-    for (const auto& item : val) {
-        status = writeByte(item);
-
-        if (status != OK) {
-            return status;
-        }
+    void* data = writeInplace(val.size());
+    if (!data) {
+        status = BAD_VALUE;
+        return status;
     }
 
-    return OK;
+    memcpy(data, val.data(), val.size());
+    return status;
 }
 
 status_t Parcel::writeInt32Vector(const std::vector<int32_t>& val)
@@ -1343,21 +1343,19 @@ status_t Parcel::readByteVector(std::vector<int8_t>* val) const {
         return status;
     }
 
-    if (size < 0) {
-        return BAD_VALUE;
+    if (size < 0 || size_t(size) > dataAvail()) {
+        status = BAD_VALUE;
+        return status;
     }
-
-    val->resize(size);
-
-    for (auto& v : *val) {
-        status = readByte(&v);
-
-        if (status != OK) {
-            return status;
-        }
+    const void* data = readInplace(size);
+    if (!data) {
+        status = BAD_VALUE;
+        return status;
     }
+    val->resize(size);
+    memcpy(val->data(), data, size);
 
-    return OK;
+    return status;
 }
 
 status_t Parcel::readInt32Vector(std::vector<int32_t>* val) const {
-- 
cgit v1.2.3