From 9adf186c5b6843b72d6768e4604768f39abe8467 Mon Sep 17 00:00:00 2001
From: Jay Shrauner <shrauner@google.com>
Date: Mon, 23 Jun 2014 14:54:26 -0700
Subject: [PATCH] Catch negative literal sizes in imap responses

Check for negative sizes for literals so that we don't crash attempting
to create a negative sized array.

Bug:15834346
Change-Id: I1fbd9b86c807f1e97100fbfe52ef402a337bf655
---
 src/com/android/email/mail/store/imap/ImapResponseParser.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/com/android/email/mail/store/imap/ImapResponseParser.java b/src/com/android/email/mail/store/imap/ImapResponseParser.java
index 0c5d07b44..4433105dc 100644
--- a/src/com/android/email/mail/store/imap/ImapResponseParser.java
+++ b/src/com/android/email/mail/store/imap/ImapResponseParser.java
@@ -438,6 +438,9 @@ public class ImapResponseParser {
         } catch (NumberFormatException nfe) {
             throw new MessagingException("Invalid length in literal");
         }
+        if (size < 0) {
+            throw new MessagingException("Invalid negative length in literal");
+        }
         expect('\r');
         expect('\n');
         FixedLengthInputStream in = new FixedLengthInputStream(mIn, size);