base: prevent StrictMode to crash system because an overflow

Sometimes StrictMode is trying to parse a bad parcel that causes the tags array to overflow,
causing a soft reboot. Although this change doesn't fix the original cause, it should prevent
OOM derived from reading the wrong parcel.

E/AndroidRuntime(  727): *** FATAL EXCEPTION IN SYSTEM PROCESS: main
E/AndroidRuntime(  727): java.lang.OutOfMemoryError: java.lang.String[] of length 1869767790 would overflow
E/AndroidRuntime(  727):        at android.os.Parcel.readStringArray(Parcel.java:1798)
E/AndroidRuntime(  727):        at android.os.StrictMode.<init>(StrictMode.java:2200)
E/AndroidRuntime(  727):        at android.os.StrictMode.readAndHandleBinderCallViolations(StrictMode.java:1738)

Change-Id: I57d10f3339053195ca75db4f7f16a1640d82148f
JIRA: CYAN-7163
Signed-off-by: Jorge Ruesga <jorge@ruesga.com>

Patchset: 1
http://review.cyanogenmod.org/#/c/120427/

core/java/android/os/StrictMode.java

@@ -1754,9 +1754,14 @@ private static class LogStackTrace extends Exception {}
                 // so we'll report it and bail on all of the current strict mode violations
                 // we currently are maintaining for this thread.
                 // First, drain the remaining violations from the parcel.
-                while (i < numViolations) {
-                    info = new ViolationInfo(p, !currentlyGathering);
-                    i++;
+                try {
+                    while (i < numViolations) {
+                        info = new ViolationInfo(p, !currentlyGathering);
+                        i++;
+                    }
+                } catch (IllegalStateException iex) {
+                    // Parcel is the wrong one or is corrupted. Stop reading draining
+                    // the parcel here.
                 }
                 // Next clear out all gathered violations.
                 clearGatheredViolations();
@@ -2217,7 +2222,26 @@ public ViolationInfo(Parcel in, boolean unsetGatheringBit) {
             violationUptimeMillis = in.readLong();
             numInstances = in.readLong();
             broadcastIntentAction = in.readString();
-            tags = in.readStringArray();
+
+            // TODO if parcel is corrupted or it's not what we expect, readStringArray() can
+            // end reading a integer that causes an overflow because of the new string array
+            // created. So instead of use readStringArray(), just read the length of the
+            // array, and in case that the length is bigger than MAX_SPAN_TAGS then
+            // we should stop reading here.
+            // FIXME this is only a patch to prevent UI to crash because an OOM exception.
+            // In deep, this is cause by a bad received parcel. We must found the orginal cause
+            // and fix it.
+            int length = in.readInt();
+            if (length > MAX_SPAN_TAGS) {
+                throw new IllegalStateException();
+            } else if (length >= 0) {
+                tags = new String[length];
+                for (int i = 0 ; i < length ; i++) {
+                    tags[i] = in.readString();
+                }
+            } else {
+                tags = null;
+            }
         }
 
         /**