Fix std::vector out-of-bounds access in Flutter Android JNI and Delegate by chingjun · Pull Request #187218 · flutter/flutter

chingjun · 2026-05-27T23:02:32Z

This CL addresses potential std::vector index out-of-bounds errors in the Flutter engine's Android native code, detected by libc++ hardening (go/cc-hardening-assertions). The issues stem from unsafe &vector[0] accesses on potentially empty vectors.

platform_view_android_jni_impl.cc (SetViewportMetrics): Added size checks before using GetIntArrayRegion on vectors created from JNI arrays, which can be empty.
platform_view_android_delegate.cc (UpdateSemantics): Moved buffer pointer initializations (e.g., &buffer[0]) and their usage to be within !empty() checks, preventing access on zero-sized vectors.

These changes ensure safe vector handling, particularly when empty data is passed via JNI.

See cl/922343981

flutter-dashboard · 2026-05-27T23:02:38Z

It looks like this pull request may not have tests. Please make sure to add tests or get an explicit test exemption before merging.

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing. If you believe this PR qualifies for a test exemption, contact "@test-exemption-reviewer" in the #hackers channel in Discord (don't just cc them here, they won't see it!). The test exemption team is a small volunteer group, so all reviewers should feel empowered to ask for tests, without delegating that responsibility entirely to the test exemption group.

gemini-code-assist

Code Review

This pull request adds safety checks to ensure that operations on std::vector buffers are only performed when they are not empty, preventing potential undefined behavior or crashes. Feedback suggests using std::vector::data() instead of &vector[0] as a cleaner and safer, idiomatic C++ standard for obtaining pointers to the underlying array.

gemini-code-assist · 2026-05-27T23:03:32Z

+      int32_t* buffer_int32 = reinterpret_cast<int32_t*>(&buffer[0]);
+      float* buffer_float32 = reinterpret_cast<float*>(&buffer[0]);


Using std::vector::data() is the standard and idiomatic way to obtain a pointer to the underlying array in modern C++. It is cleaner and safer than using &vector[0].

Suggested change

int32_t* buffer_int32 = reinterpret_cast<int32_t*>(&buffer[0]);

float* buffer_float32 = reinterpret_cast<float*>(&buffer[0]);

int32_t* buffer_int32 = reinterpret_cast<int32_t*>(buffer.data());

float* buffer_float32 = reinterpret_cast<float*>(buffer.data());

References

The repository follows the Google C++ Style Guide, which encourages modern, safe, and idiomatic C++ practices. Using std::vector::data() is preferred over &vector[0] as it is the standard way to access the underlying array and is safe even when the vector might be empty (returning nullptr instead of causing undefined behavior). ^(link)

gemini-code-assist · 2026-05-27T23:03:32Z

+      int32_t* actions_buffer_int32 =
+          reinterpret_cast<int32_t*>(&actions_buffer[0]);


Using std::vector::data() is the standard and idiomatic way to obtain a pointer to the underlying array in modern C++. It is cleaner and safer than using &vector[0].

Suggested change

int32_t* actions_buffer_int32 =

reinterpret_cast<int32_t*>(&actions_buffer[0]);

int32_t* actions_buffer_int32 =

reinterpret_cast<int32_t*>(actions_buffer.data());

References

The repository follows the Google C++ Style Guide, which encourages modern, safe, and idiomatic C++ practices. Using std::vector::data() is preferred over &vector[0] as it is the standard way to access the underlying array and is safe even when the vector might be empty (returning nullptr instead of causing undefined behavior). ^(link)

Changed all the &vec[0] in this file to vec.data()

gemini-code-assist · 2026-05-27T23:03:32Z

-                         &boundsIntVector[0]);
+  if (rectSize > 0) {
+    env->GetIntArrayRegion(javaDisplayFeaturesBounds, 0, rectSize,
+                           &boundsIntVector[0]);


Using std::vector::data() is the standard and idiomatic way to obtain a pointer to the underlying array in modern C++. It is cleaner and safer than using &vector[0].

boundsIntVector.data());

References

The repository follows the Google C++ Style Guide, which encourages modern, safe, and idiomatic C++ practices. Using std::vector::data() is preferred over &vector[0] as it is the standard way to access the underlying array and is safe even when the vector might be empty (returning nullptr instead of causing undefined behavior). ^(link)

gemini-code-assist · 2026-05-27T23:03:33Z

-                         &displayFeaturesType[0]);
+  if (typeSize > 0) {
+    env->GetIntArrayRegion(javaDisplayFeaturesType, 0, typeSize,
+                           &displayFeaturesType[0]);


Using std::vector::data() is the standard and idiomatic way to obtain a pointer to the underlying array in modern C++. It is cleaner and safer than using &vector[0].

displayFeaturesType.data());

References

The repository follows the Google C++ Style Guide, which encourages modern, safe, and idiomatic C++ practices. Using std::vector::data() is preferred over &vector[0] as it is the standard way to access the underlying array and is safe even when the vector might be empty (returning nullptr instead of causing undefined behavior). ^(link)

gemini-code-assist · 2026-05-27T23:03:33Z

-                         &displayFeaturesState[0]);
+  if (stateSize > 0) {
+    env->GetIntArrayRegion(javaDisplayFeaturesState, 0, stateSize,
+                           &displayFeaturesState[0]);


Using std::vector::data() is the standard and idiomatic way to obtain a pointer to the underlying array in modern C++. It is cleaner and safer than using &vector[0].

displayFeaturesState.data());

References

The repository follows the Google C++ Style Guide, which encourages modern, safe, and idiomatic C++ practices. Using std::vector::data() is preferred over &vector[0] as it is the standard way to access the underlying array and is safe even when the vector might be empty (returning nullptr instead of causing undefined behavior). ^(link)

reidbaker · 2026-06-08T19:54:33Z

Sorry you waited on my review. I do not have a strong enough understanding of c code to review this change.

Added @gaaclarke to find a better reviewer.

gaaclarke

Thanks @chingjun, what about tests?

gaaclarke · 2026-06-08T20:37:19Z

+      jni_facade_->FlutterViewUpdateSemantics(buffer, strings,
+                                              string_attribute_args);
    }


This is changing the order of FlutterViewUpdateSemantics and FlutterViewUpdateCustomAccessibilityActions. It'd be safer to keep that order.

Updated, kept the original order.

gaaclarke · 2026-06-08T20:38:26Z

+      int32_t* actions_buffer_int32 =
+          reinterpret_cast<int32_t*>(&actions_buffer[0]);


This CL addresses potential `std::vector` index out-of-bounds errors in the Flutter engine's Android native code, detected by libc++ hardening (go/cc-hardening-assertions). The issues stem from unsafe `&vector[0]` accesses on potentially empty vectors. 1. **platform_view_android_jni_impl.cc (SetViewportMetrics):** Added size checks before using `GetIntArrayRegion` on vectors created from JNI arrays, which can be empty. 2. **platform_view_android_delegate.cc (UpdateSemantics):** Moved buffer pointer initializations (e.g., `&buffer[0]`) and their usage to be within `!empty()` checks, preventing access on zero-sized vectors. These changes ensure safe vector handling, particularly when empty data is passed via JNI. See cl/922343981

chingjun · 2026-06-12T17:23:54Z

@gaaclarke Added tests for this. I have to admit that I don't know much about this (I didn't author the original PR anyway, only helping them to send it here) so I asked Gemini for help, please check if the tests added by Gemini makes sense. Thanks!

gaaclarke

lgtm!

Roll Flutter from b7cb925419e6 to 5827d5fd2b8d (35 revisions) flutter/flutter@b7cb925...5827d5f 2026-06-15 engine-flutter-autoroll@skia.org Roll Skia from 7128af60575a to c8d9f80f13e4 (1 revision) (flutter/flutter#188015) 2026-06-15 jason-simmons@users.noreply.github.com In the APNG decoder, validate the chunk data length before calling GetChunkSize to avoid potential overflow in the chunk size calculation (flutter/flutter#187949) 2026-06-15 engine-flutter-autoroll@skia.org Roll Skia from 6b4ac3bfb39d to 7128af60575a (1 revision) (flutter/flutter#188011) 2026-06-15 engine-flutter-autoroll@skia.org Roll Skia from 0a3b8549cbf0 to 6b4ac3bfb39d (7 revisions) (flutter/flutter#188007) 2026-06-15 98614782+auto-submit[bot]@users.noreply.github.com Reverts "[a11y] Map some framework semantics roles to android classes. (#185217)" (flutter/flutter#188008) 2026-06-15 chris@bracken.jp [ios] Filter UIScene events to those relating to Flutter VC scene (flutter/flutter#187987) 2026-06-15 jhy03261997@gmail.com [a11y] Map some framework semantics roles to android classes. (flutter/flutter#185217) 2026-06-15 engine-flutter-autoroll@skia.org Roll Skia from f46928e7f50c to 0a3b8549cbf0 (1 revision) (flutter/flutter#188004) 2026-06-14 stuartmorgan@google.com Rework docs for flutter/packages changelogs (flutter/flutter#187666) 2026-06-14 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from nvzMQAmuRSzo7-wAP... to TbB86Po_HDe1dvXvT... (flutter/flutter#187997) 2026-06-14 engine-flutter-autoroll@skia.org Roll Skia from 4e2c9b5e4dad to f46928e7f50c (1 revision) (flutter/flutter#187996) 2026-06-14 engine-flutter-autoroll@skia.org Roll Skia from c52667607242 to 4e2c9b5e4dad (1 revision) (flutter/flutter#187990) 2026-06-14 737941+loic-sharma@users.noreply.github.com Improve RenderTargetCache docs (flutter/flutter#187893) 2026-06-13 brackenavaron@gmail.com [Test cross_imports] Check cross imports in flutter_test/** (flutter/flutter#187587) 2026-06-13 matt.kosarek@canonical.com Fixing corrupted window size OnEmptyFrameGenerated due to transpsed width/height (flutter/flutter#187954) 2026-06-13 engine-flutter-autoroll@skia.org Roll Skia from 42355271a335 to c52667607242 (2 revisions) (flutter/flutter#187979) 2026-06-13 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from A3eaUn9mQ_EkSNxVI... to nvzMQAmuRSzo7-wAP... (flutter/flutter#187975) 2026-06-13 engine-flutter-autoroll@skia.org Roll Skia from 9ef46390c2d1 to 42355271a335 (1 revision) (flutter/flutter#187974) 2026-06-13 bdero@google.com [Flutter GPU] Make ShaderLibrary.fromAsset asynchronous (flutter/flutter#187716) 2026-06-13 engine-flutter-autoroll@skia.org Roll Skia from 8c89bf2b0ee3 to 9ef46390c2d1 (6 revisions) (flutter/flutter#187968) 2026-06-12 bdero@google.com [Flutter GPU] Add surface API for framework presentation (flutter/flutter#187358) 2026-06-12 bkonyi@google.com [gen_l10n] Exclude inherited keys from untranslated-messages-file (flutter/flutter#187950) 2026-06-12 31859944+LongCatIsLooong@users.noreply.github.com Update `MediaQueryData` docs for devicePixelRatio overriding (flutter/flutter#187542) 2026-06-12 bdero@google.com [Impeller] Fix dirty-range race in DeviceBufferGLES uploads (flutter/flutter#187932) 2026-06-12 pascal@phntm.xyz Compare isModifiedAfter against the given time (flutter/flutter#187727) 2026-06-12 planetmarshall@users.noreply.github.com Enable unit tests for compilation of compute shaders on non-metal backends (flutter/flutter#179683) 2026-06-12 matt.boetger@gmail.com [flutter_tools] Add doctor validator warning for multiple adb installations (flutter/flutter#186031) 2026-06-12 matt.boetger@gmail.com Optimize SHA hash calculation of generated APK (flutter/flutter#187184) 2026-06-12 mu7ammadkamel@hotmail.com Scope widget inspector overlay to the selected widget's modal route (flutter/flutter#186784) 2026-06-12 30870216+gaaclarke@users.noreply.github.com Switches Windows to OpenGLESSDF (flutter/flutter#187877) 2026-06-12 matt.boetger@gmail.com [integration_test] Update README to support modern Kotlin-based setups by default (flutter/flutter#186080) 2026-06-12 jason-simmons@users.noreply.github.com Convert the PNG signature constant in APNGImageGenerator to a std::array and use it in the APNG tests (flutter/flutter#187930) 2026-06-12 matt.boetger@gmail.com Correct backoff retry time cap unit and add regression tests (flutter/flutter#187250) 2026-06-12 chingjun@google.com Fix std::vector out-of-bounds access in Flutter Android JNI and Delegate (flutter/flutter#187218) 2026-06-12 matt.boetger@gmail.com [Android] Adding 30-second timeouts to adb stopApp and uninstallApp (flutter/flutter#187876) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-packages Please CC bmparr@google.com,stuartmorgan@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 ...

…ate (flutter#187218) This CL addresses potential `std::vector` index out-of-bounds errors in the Flutter engine's Android native code, detected by libc++ hardening (go/cc-hardening-assertions). The issues stem from unsafe `&vector[0]` accesses on potentially empty vectors. 1. **platform_view_android_jni_impl.cc (SetViewportMetrics):** Added size checks before using `GetIntArrayRegion` on vectors created from JNI arrays, which can be empty. 2. **platform_view_android_delegate.cc (UpdateSemantics):** Moved buffer pointer initializations (e.g., `&buffer[0]`) and their usage to be within `!empty()` checks, preventing access on zero-sized vectors. These changes ensure safe vector handling, particularly when empty data is passed via JNI. See cl/922343981

chingjun requested a review from reidbaker May 27, 2026 23:02

chingjun requested a review from a team as a code owner May 27, 2026 23:02

flutter-dashboard Bot added the CICD Run CI/CD label May 27, 2026

github-actions Bot added platform-android Android applications specifically engine flutter/engine related. See also e: labels. team-android Owned by Android platform team labels May 27, 2026

gemini-code-assist Bot reviewed May 27, 2026

View reviewed changes

reidbaker requested review from gaaclarke and gmackall and removed request for a team and reidbaker June 8, 2026 19:53

reidbaker removed the request for review from gmackall June 8, 2026 19:54

gaaclarke reviewed Jun 8, 2026

View reviewed changes

github-actions Bot removed the CICD Run CI/CD label Jun 10, 2026

flutter-dashboard Bot added the CICD Run CI/CD label Jun 10, 2026

chingjun added 3 commits June 11, 2026 14:13

Review feedback

4d13315

Add tests

5a5d9b0

chingjun force-pushed the engine-android-fix branch from 96136ee to 5a5d9b0 Compare June 11, 2026 21:13

github-actions Bot removed the CICD Run CI/CD label Jun 11, 2026

chingjun added the CICD Run CI/CD label Jun 11, 2026

gaaclarke approved these changes Jun 12, 2026

View reviewed changes

chingjun added the autosubmit Merge PR when tree becomes green via auto submit App label Jun 12, 2026

auto-submit Bot added this pull request to the merge queue Jun 12, 2026

Merged via the queue into flutter:master with commit b4bfa3e Jun 12, 2026
206 checks passed

flutter-dashboard Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jun 12, 2026

		int32_t* buffer_int32 = reinterpret_cast<int32_t*>(&buffer[0]);
		float* buffer_float32 = reinterpret_cast<float*>(&buffer[0]);

		int32_t* actions_buffer_int32 =
		reinterpret_cast<int32_t*>(&actions_buffer[0]);

Uh oh!

Conversation

chingjun commented May 27, 2026

Uh oh!

flutter-dashboard Bot commented May 27, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

gaaclarke Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

chingjun Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

reidbaker commented Jun 8, 2026

Uh oh!

gaaclarke left a comment

Choose a reason for hiding this comment

Uh oh!

gaaclarke Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

chingjun Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gaaclarke Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

chingjun commented Jun 12, 2026

Uh oh!

gaaclarke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants