* [Android] Avoid ArrayIndexOutOfBounds in RenderPage::MoveRenderObje…

…ct (#2919) * * [Android] Avoid ArrayIndexOutOfBounds in RenderPage::MoveRenderObject * Update import
apache · Sep 23, 2019 · ec1ec23 · ec1ec23
1 parent e8f323a
commit ec1ec23
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/android/sdk/src/main/java/com/taobao/weex/bridge/WXBridgeManager.java b/android/sdk/src/main/java/com/taobao/weex/bridge/WXBridgeManager.java
@@ -152,6 +152,7 @@ public class WXBridgeManager implements Callback, BactchExecutor {
   public static final String METHOD_UPDATE_COMPONENT_WITH_DATA = "UpdateComponentData";
   private static final String METHOD_POST_TASK_TO_MSG_LOOP = "PostTaskToMsgLoop";
   private static final String METHOD_JSFM_NOT_INIT_IN_EAGLE_MODE = "JsfmNotInitInEagleMode";
+  private static final String METHOD_MOVE_RENDER_OBJECT = "RenderPage::MoveRenderObject";
   public static final String METHOD_DESTROY_INSTANCE = "destroyInstance";
   public static final String METHOD_CALL_JS = "callJS";
   public static final String METHOD_SET_TIMEOUT = "setTimeoutCallback";
@@ -2585,6 +2586,8 @@ public void reportJSException(String instanceId, String function,
               METHOD_JSFM_NOT_INIT_IN_EAGLE_MODE.equals(function) )
           && !instance.getApmForInstance().hasAddView){
         reportErrorCode = WXErrorCode.WX_DEGRAD_EAGLE_RENDER_ERROR;
+      } else if (METHOD_MOVE_RENDER_OBJECT.equals(function)) {
+        reportErrorCode = WXErrorCode.WX_ERROR_MOVE_RENDER_OBJECT_OUT_OF_BOUNDS;
       }
       instance.onJSException(reportErrorCode.getErrorCode(), function, exception);
     }

diff --git a/android/sdk/src/main/java/com/taobao/weex/common/WXErrorCode.java b/android/sdk/src/main/java/com/taobao/weex/common/WXErrorCode.java
@@ -276,6 +276,9 @@ public enum WXErrorCode {
 
   WX_ERR_HASH_MAP_TMP("-10010", "WX_ERR_HASH_MAP_TMP",ErrorType.NATIVE_ERROR,ErrorGroup.NATIVE),
 
+  WX_ERROR_MOVE_RENDER_OBJECT_OUT_OF_BOUNDS("-2120", "Index out of bounds when move element",
+      ErrorType.NATIVE_ERROR, ErrorGroup.JS),
+
   /**
    * TEST
    */

diff --git a/weex_core/Source/core/render/page/render_page.cpp b/weex_core/Source/core/render/page/render_page.cpp
@@ -221,6 +221,16 @@ bool RenderPage::MoveRenderObject(const std::string &ref,
     }
   }
 
+  if(index > new_parent->getChildCount()){
+    std::stringstream msg;
+    msg << "Out of array bounds when RenderPage::MoveRenderObject, specified index: "
+    << index << "array size " << new_parent->getChildCount();
+
+    WeexCore::WeexCoreManager::Instance()->getPlatformBridge()->platform_side()
+    ->ReportException(page_id().c_str(), "RenderPage::MoveRenderObject", msg.str().c_str());
+    return false;
+  }
+
   set_is_dirty(true);
   child->getParent()->removeChild(child);
   new_parent->addChildAt(child, index);