commit 1e72dc7a3074cd0b44d89afbf39bbf5000ef7cc3
author Leon Scroggins III <scroggo@google.com> Fri May 29 16:13:11 2015 -0400
committer The Android Automerger <android-build@google.com> Thu Aug 13 19:41:42 2015 -0700
tree f70ab923ed48b4b7d64d8f398de6a383c79b2f1a
parent 4cff1f49ff95d990d6c2614da5d5a23d02145885

DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes

bug: 20883006
Change-Id: I4f109667fb210a80fbddddf5f1bfb7ef3a02b6ce

core/jni/android/graphics/Region.cpp

diff --git a/core/jni/android/graphics/Region.cpp b/core/jni/android/graphics/Region.cpp
index 6b99de8..ec4d8bf 100644
--- a/core/jni/android/graphics/Region.cpp
+++ b/core/jni/android/graphics/Region.cpp
@@ -218,7 +218,12 @@
         return NULL;
     }
     SkRegion* region = new SkRegion;
-    region->readFromMemory(regionData, size);
+    size_t actualSize = region->readFromMemory(regionData, size);
+
+    if (size != actualSize) {
+        delete region;
+        return NULL;
+    }
 
     return reinterpret_cast<jlong>(region);
 }