Merge cherrypicks of ['googleplex-android-review.googlesource.com/27416926'] into udc-platform-release.

Change-Id: I5ddc0c392e285a8d890f05e46e3ff14b67b68f12

java/com/android/modules/utils/BinaryXmlSerializer.java

diff --git a/java/com/android/modules/utils/BinaryXmlSerializer.java b/java/com/android/modules/utils/BinaryXmlSerializer.java
index 7c0217e..9fdb818 100644
--- a/java/com/android/modules/utils/BinaryXmlSerializer.java
+++ b/java/com/android/modules/utils/BinaryXmlSerializer.java
@@ -16,6 +16,8 @@
 
 package com.android.modules.utils;
 
+import static com.android.modules.utils.FastDataOutput.MAX_UNSIGNED_SHORT;
+
 import static org.xmlpull.v1.XmlPullParser.CDSECT;
 import static org.xmlpull.v1.XmlPullParser.COMMENT;
 import static org.xmlpull.v1.XmlPullParser.DOCDECL;
@@ -224,6 +226,10 @@
         if (namespace != null && !namespace.isEmpty()) throw illegalNamespace();
         mOut.writeByte(ATTRIBUTE | TYPE_BYTES_HEX);
         mOut.writeInternedUTF(name);
+        if (value.length > MAX_UNSIGNED_SHORT) {
+            throw new IOException("attributeBytesHex: input size (" + value.length
+                    + ") exceeds maximum allowed size (" + MAX_UNSIGNED_SHORT + ")");
+        }
         mOut.writeShort(value.length);
         mOut.write(value);
         return this;
@@ -235,6 +241,10 @@
         if (namespace != null && !namespace.isEmpty()) throw illegalNamespace();
         mOut.writeByte(ATTRIBUTE | TYPE_BYTES_BASE64);
         mOut.writeInternedUTF(name);
+        if (value.length > MAX_UNSIGNED_SHORT) {
+            throw new IOException("attributeBytesBase64: input size (" + value.length
+                    + ") exceeds maximum allowed size (" + MAX_UNSIGNED_SHORT + ")");
+        }
         mOut.writeShort(value.length);
         mOut.write(value);
         return this;