d1dff8d4d4
If writeString8 is called with the following sequence:
writeString8(String8(""));
writeString8(String8("TempString"));
Then in the readString8, the 2nd String i.e. "TempString" is not read,
instead an empty string is read.
The bug comes because of the write call for String8("") where there are
no String bytes present. In the write Statement, an extra ‘\0’ is
written. During the Marshalling, Following bytes are written:
1 2 3 4 5 ...
0x0 0x0 0xB ‘T’ ‘e’ ...
The readString8 function has a check that, if String length is 0, don’t
read anything. So the first byte is read as the length for the first
string. The second byte i.e. ‘\0’ is read as the length for the second
string and hence the second string becomes empty too.
Change-Id: Id7acc0c80ae16e77be4331f1ddf69ea87e758420
|
||
|---|---|---|
| .. | ||
| Android.mk | ||
| Binder.cpp | ||
| BpBinder.cpp | ||
| IInterface.cpp | ||
| IMemory.cpp | ||
| IPCThreadState.cpp | ||
| IPermissionController.cpp | ||
| IServiceManager.cpp | ||
| MemoryBase.cpp | ||
| MemoryDealer.cpp | ||
| MemoryHeapBase.cpp | ||
| MemoryHeapPmem.cpp | ||
| Parcel.cpp | ||
| Permission.cpp | ||
| ProcessState.cpp | ||
| Static.cpp | ||