Code: static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
{
 if (parcel == NULL) {
 return NULL;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 const size_t size = p->readInt32();
 const void* regionData = p->readInplace(size);
 if (regionData == NULL) {

         return NULL;
     }
     SkRegion* region = new SkRegion;
    region->readFromMemory(regionData, size);
 
     return reinterpret_cast<jlong>(region);
 }

Vulnerability Type: Exec Code 
CWE ID: CWE-264
Summary: The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.
Commit Message: DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes

bug: 20883006
Change-Id: I4f109667fb210a80fbddddf5f1bfb7ef3a02b6ce
