fix(mobile): cronet thumbnail buffer overflow regression from #28439 (#28450)

The hybrid added in onReadCompleted reuses Cronet's ByteBuffer between
reads to save a JNI wrap call when no grow is needed. That reuse breaks
advance() — Cronet's position() is cumulative across reads, so the same
K bytes get counted on every subsequent iteration. b.offset overshoots
b.capacity, the reuse branch keeps firing on a now-empty buffer, and
request.read() throws the original IllegalArgumentException again.

Always pass a fresh wrap from wrapRemaining() so byteBuffer.position()
reflects only this iteration's bytes. Same shape as the original PR
had before the broken optimization was layered on top.
pull/28452/head
Santo Shakil 2026-05-16 03:25:31 +06:00 committed by GitHub
parent 01d6a244d8
commit 17779c1e74
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 12 deletions

View File

@ -265,18 +265,14 @@ private class CronetImageFetcher : ImageFetcher {
byteBuffer: ByteBuffer
) {
try {
val b = buffer!!
b.advance(byteBuffer.position())
// Reuse the caller-supplied ByteBuffer as long as we don't need to grow.
// It already points at our native memory with position advanced past the
// written bytes — Cronet can keep writing into the remaining tail.
// Only when the buffer is full do we grow (which may realloc + move the
// native pointer) and need a fresh wrap.
val buf = if (b.offset == b.capacity) {
b.ensureHeadroom()
b.wrapRemaining()
} else {
byteBuffer
// Always pass a fresh wrap so byteBuffer.position() represents only the
// bytes Cronet wrote in this iteration. Reusing the caller-supplied
// ByteBuffer breaks advance(): Cronet's position keeps accumulating
// across reads, which would double-count previous iterations' bytes.
val buf = buffer!!.run {
advance(byteBuffer.position())
ensureHeadroom()
wrapRemaining()
}
request.read(buf)
} catch (e: Exception) {