Fix off-by-one bug when calculating the bundle size

git-core · git-core · commit cf50c028d866 · 2012-01-11T23:55:34.000+04:00
Remember position in parcel before adding bundle signature. The old code supposed to
work by chance: the resolved type was NULL (so only -1 as int32 was stored in
the parcel) and redundant -1 (as int32) was added after the resolved type.
Thus, the former was actually a null string in the bundle and the latter acted the part
of the (null) resolved type.

Don't put garbage at the end of intent (after sticky which is supposed to be
the last parameter in an intent). Again, it seemed to work before due to Android stops
to parse intent just after it gets all required parameters.
diff --git a/activity.cpp b/activity.cpp
@@ -87,8 +87,8 @@ int send_intent(struct su_initiator *from, struct su_request *to, const char *so
     }
     { /* Extras */
         data.writeInt32(-1); /* dummy, will hold length */
-        int oldPos = data.dataPosition();
         data.writeInt32(0x4C444E42); // 'B' 'N' 'D' 'L'
+        int oldPos = data.dataPosition();
         { /* writeMapInternal */
             data.writeInt32(7); /* writeMapInternal - size */
 
@@ -128,15 +128,13 @@ int send_intent(struct su_initiator *from, struct su_request *to, const char *so
             data.writeInt32(VERSION_CODE);
         }
         int newPos = data.dataPosition();
-        data.setDataPosition(oldPos - 4);
+        data.setDataPosition(oldPos - 8);
         data.writeInt32(newPos - oldPos); /* length */
         data.setDataPosition(newPos);
     }
 
     data.writeString16(NULL, 0); /* resolvedType */
 
-    data.writeInt32(-1); /* Not sure what this is for, but it prevents a warning */
-
     data.writeStrongBinder(NULL); /* resultTo */
     data.writeInt32(-1); /* resultCode */
     data.writeString16(NULL, 0); /* resultData */
@@ -146,7 +144,6 @@ int send_intent(struct su_initiator *from, struct su_request *to, const char *so
     data.writeString16(String16("com.noshufou.android.su.RESPOND")); /* perm */
     data.writeInt32(0); /* serialized */
     data.writeInt32(0); /* sticky */
-    data.writeInt32(-1);
     
     status_t ret = am->transact(BROADCAST_INTENT_TRANSACTION, data, &reply);
     if (ret < START_SUCCESS) return -1;
