diff options
| author | Siyamed Sinir <siyamed@google.com> | 2016-06-03 16:22:17 -0700 |
|---|---|---|
| committer | Siyamed Sinir <siyamed@google.com> | 2016-06-03 18:11:45 -0700 |
| commit | eb4df8a82281ee9b2490eebc3c2eef8d669deb87 (patch) | |
| tree | def4b807c78dce4c38d3983dbd9c065205d522e0 /core/java/android | |
| parent | e34bb5a1ffc5fe35b2fbc58824ad5bfbc7ecad3d (diff) | |
Fix int overflow in SpannableStringBuilder.replace
During the offset calculation for selection, SpannableStringBuilder
had an overflow while multiplying two int values. This CL uses long to
calculate the multiplication, and also checks for overflow after
casting the final result into int again.
Bug: 29108549
Change-Id: I11eff4677916701074b38bc5214730fe704707c4
Diffstat (limited to 'core/java/android')
| -rw-r--r-- | core/java/android/text/SpannableStringBuilder.java | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/core/java/android/text/SpannableStringBuilder.java b/core/java/android/text/SpannableStringBuilder.java index 787202eded02..dc8e4b93e093 100644 --- a/core/java/android/text/SpannableStringBuilder.java +++ b/core/java/android/text/SpannableStringBuilder.java @@ -19,7 +19,6 @@ package android.text; import android.annotation.Nullable; import android.graphics.Canvas; import android.graphics.Paint; -import android.text.style.ParagraphStyle; import android.util.Log; import com.android.internal.util.ArrayUtils; @@ -554,7 +553,8 @@ public class SpannableStringBuilder implements CharSequence, GetChars, Spannable if (adjustSelection) { boolean changed = false; if (selectionStart > start && selectionStart < end) { - final int offset = (selectionStart - start) * newLen / origLen; + final long diff = selectionStart - start; + final int offset = Math.toIntExact(diff * newLen / origLen); selectionStart = start + offset; changed = true; @@ -562,7 +562,8 @@ public class SpannableStringBuilder implements CharSequence, GetChars, Spannable Spanned.SPAN_POINT_POINT); } if (selectionEnd > start && selectionEnd < end) { - final int offset = (selectionEnd - start) * newLen / origLen; + final long diff = selectionEnd - start; + final int offset = Math.toIntExact(diff * newLen / origLen); selectionEnd = start + offset; changed = true; |