commit 3c522898394697b89e7e2cb9b851b395db255ef8
author Phil Weaver <pweaver@google.com> Thu Apr 06 17:40:51 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed May 31 18:07:27 2017 +0000
tree 369a35ef34fdcfed3e4335443b84696dd70081d5
parent 894d63476f7ea70a5c807add125765d7c82cb0e5

Make a11y node info parceling more robust

Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.

Bug: 36491278
Test: Verified that POC no longer works, a11y cts still passes.
Change-Id: I10f24747e3ab87d77cd1deba56db4526e3aa5441
(cherry picked from commit 687bb44b437f7bb24dd3dddf072c2f646308e2ca)
(cherry picked from commit 475719d03d9199433edfccb0e1e0e456552e59d7)

core/java/android/view/accessibility/AccessibilityNodeInfo.java

diff --git a/core/java/android/view/accessibility/AccessibilityNodeInfo.java b/core/java/android/view/accessibility/AccessibilityNodeInfo.java
index c1076e7..8463a1a 100644
--- a/core/java/android/view/accessibility/AccessibilityNodeInfo.java
+++ b/core/java/android/view/accessibility/AccessibilityNodeInfo.java
@@ -2760,16 +2760,19 @@
 
         if (mActions != null && !mActions.isEmpty()) {
             final int actionCount = mActions.size();
-            parcel.writeInt(actionCount);
 
+            int nonLegacyActionCount = 0;
             int defaultLegacyStandardActions = 0;
             for (int i = 0; i < actionCount; i++) {
                 AccessibilityAction action = mActions.get(i);
                 if (isDefaultLegacyStandardAction(action)) {
                     defaultLegacyStandardActions |= action.getId();
+                } else {
+                    nonLegacyActionCount++;
                 }
             }
             parcel.writeInt(defaultLegacyStandardActions);
+            parcel.writeInt(nonLegacyActionCount);
 
             for (int i = 0; i < actionCount; i++) {
                 AccessibilityAction action = mActions.get(i);
@@ -2780,6 +2783,7 @@
             }
         } else {
             parcel.writeInt(0);
+            parcel.writeInt(0);
         }
 
         parcel.writeInt(mMaxTextLength);
@@ -2947,16 +2951,13 @@
         mBoundsInScreen.left = parcel.readInt();
         mBoundsInScreen.right = parcel.readInt();
 
-        final int actionCount = parcel.readInt();
-        if (actionCount > 0) {
-            final int legacyStandardActions = parcel.readInt();
-            addLegacyStandardActions(legacyStandardActions);
-            final int nonLegacyActionCount = actionCount - Integer.bitCount(legacyStandardActions);
-            for (int i = 0; i < nonLegacyActionCount; i++) {
-                final AccessibilityAction action = new AccessibilityAction(
-                        parcel.readInt(), parcel.readCharSequence());
-                addActionUnchecked(action);
-            }
+        final int legacyStandardActions = parcel.readInt();
+        addLegacyStandardActions(legacyStandardActions);
+        final int nonLegacyActionCount = parcel.readInt();
+        for (int i = 0; i < nonLegacyActionCount; i++) {
+            final AccessibilityAction action = new AccessibilityAction(
+                    parcel.readInt(), parcel.readCharSequence());
+            addActionUnchecked(action);
         }
 
         mMaxTextLength = parcel.readInt();