Code: static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
 if (parcel == NULL) {
 SkDebugf("-------- unparcel parcel is NULL\n");
 return NULL;
 }

    android::Parcel* p = android::parcelForJavaObject(env, parcel);

 const bool        isMutable = p->readInt32() != 0;
 const SkColorType colorType = (SkColorType)p->readInt32();
 const SkAlphaType alphaType = (SkAlphaType)p->readInt32();
 const int         width = p->readInt32();
 const int         height = p->readInt32();
 const int         rowBytes = p->readInt32();
 const int         density = p->readInt32();

 if (kN32_SkColorType != colorType &&
            kRGB_565_SkColorType != colorType &&
            kARGB_4444_SkColorType != colorType &&
            kIndex_8_SkColorType != colorType &&
            kAlpha_8_SkColorType != colorType) {
 SkDebugf("Bitmap_createFromParcel unknown colortype: %d\n", colorType);

         return NULL;
     }
 
    SkBitmap* bitmap = new SkBitmap;
 
    bitmap->setInfo(SkImageInfo::Make(width, height, colorType, alphaType), rowBytes);
 
     SkColorTable* ctable = NULL;
     if (colorType == kIndex_8_SkColorType) {
         int count = p->readInt32();
         if (count > 0) {
             size_t size = count * sizeof(SkPMColor);
             const SkPMColor* src = (const SkPMColor*)p->readInplace(size);
             ctable = new SkColorTable(src, count);
         }
     }
 
    jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable);
     if (NULL == buffer) {
         SkSafeUnref(ctable);
        delete bitmap;
         return NULL;
     }
 
 SkSafeUnref(ctable);

 size_t size = bitmap->getSize();

    android::Parcel::ReadableBlob blob;

     android::status_t status = p->readBlob(size, &blob);
     if (status) {
         doThrowRE(env, "Could not read bitmap from parcel blob.");
        delete bitmap;
         return NULL;
     }
 
    bitmap->lockPixels();
    memcpy(bitmap->getPixels(), blob.data(), size);
    bitmap->unlockPixels();

 
     blob.release();
 
    return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable),
            NULL, NULL, density);
 }

Vulnerability Type: DoS Overflow +Info 
CWE ID: CWE-189
Summary: Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.
Commit Message: Make Bitmap_createFromParcel check the color count. DO NOT MERGE

When reading from the parcel, if the number of colors is invalid, early
exit.

Add two more checks: setInfo must return true, and Parcel::readInplace
must return non-NULL. The former ensures that the previously read values
(width, height, etc) were valid, and the latter checks that the Parcel
had enough data even if the number of colors was reasonable.

Also use an auto-deleter to handle deletion of the SkBitmap.

Cherry pick from change-Id: Icbd562d6d1f131a723724883fd31822d337cf5a6

BUG=19666945

Change-Id: Iab0d218c41ae0c39606e333e44cda078eef32291
