commit dbce71357e908e88547661978784e71af51f1ead
author Fyodor Kupolov <fkupolov@google.com> Wed Feb 22 14:12:50 2017 -0800
committer gitbuildkicker <android-build@google.com> Thu Mar 23 10:57:24 2017 -0700
tree 601b0a5fabbaef2ba5aebc94314018cb5866ceec
parent 8aa9d3d330fb8616da66f16f00f701c4f30a6e95

[DO NOT MERGE] Throw exception if slot has invalid offset

Previously the process would crash, which is OK, but complicates testing.

Test: cts-tradefed run cts --module CtsContentTestCases
      --test android.content.cts.ContentProviderCursorWindowTest
Bug: 34128677

Change-Id: I5b50982d77ec65c442fbb973d14c85a5c29c43c7
(cherry picked from commit eb6de6f5f10148b9f81f9c0074d1e1f7af21bfb0)
(cherry picked from commit 676f703f746391cfdf05bafd2289226f7a6e5255)

core/jni/android_database_CursorWindow.cpp

diff --git a/core/jni/android_database_CursorWindow.cpp b/core/jni/android_database_CursorWindow.cpp
index e96613b..0d65a18 100644
--- a/core/jni/android_database_CursorWindow.cpp
+++ b/core/jni/android_database_CursorWindow.cpp
@@ -205,6 +205,10 @@
     if (type == CursorWindow::FIELD_TYPE_BLOB || type == CursorWindow::FIELD_TYPE_STRING) {
         size_t size;
         const void* value = window->getFieldSlotValueBlob(fieldSlot, &size);
+        if (!value) {
+            throw_sqlite3_exception(env, "Native could not read blob slot");
+            return NULL;
+        }
         jbyteArray byteArray = env->NewByteArray(size);
         if (!byteArray) {
             env->ExceptionClear();
@@ -240,6 +244,10 @@
     if (type == CursorWindow::FIELD_TYPE_STRING) {
         size_t sizeIncludingNull;
         const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
+        if (!value) {
+            throw_sqlite3_exception(env, "Native could not read string slot");
+            return NULL;
+        }
         if (sizeIncludingNull <= 1) {
             return gEmptyString;
         }