Add better index checks for AndroidCharacter.mirror
Fix potential invalid array access if start index is before the
beginning of the array or start + count is past the end of the array.
Update Javadoc for mirror to reflect the usage of "start" and "count".
Change-Id: I7e596de8eae5c518a2b4ff0d28604bd9c59f9d9d
diff --git a/core/java/android/text/AndroidCharacter.java b/core/java/android/text/AndroidCharacter.java
index af93b5d..05887c5 100644
--- a/core/java/android/text/AndroidCharacter.java
+++ b/core/java/android/text/AndroidCharacter.java
@@ -73,6 +73,11 @@
* Replace the specified slice of <code>text</code> with the chars'
* right-to-left mirrors (if any), returning true if any
* replacements were made.
+ *
+ * @param text array of characters to apply mirror operation
+ * @param start first character in array to mirror
+ * @param count maximum number of characters to mirror
+ * @return true if replacements were made
*/
public native static boolean mirror(char[] text, int start, int count);
diff --git a/core/jni/android_text_AndroidCharacter.cpp b/core/jni/android_text_AndroidCharacter.cpp
index 1353478..5d8d419 100644
--- a/core/jni/android_text_AndroidCharacter.cpp
+++ b/core/jni/android_text_AndroidCharacter.cpp
@@ -165,7 +165,8 @@
goto MIRROR_END;
}
- if (start > start + count || env->GetArrayLength(charArray) < count) {
+ if (start < 0 || start > start + count
+ || env->GetArrayLength(charArray) < start + count) {
jniThrowException(env, "java/lang/ArrayIndexOutOfBoundsException", NULL);
goto MIRROR_END;
}
