{"record":{"id":"a1a6addaf68c85b6","repo":"microg/GmsCore","slug":"size-read-is-invalid-start-start-end-e","errorCode":null,"errorMessage":"Size read is invalid start=\" + start + \" end=\" + end","messagePattern":"Size read is invalid start=\" \\+ start \\+ \" end=\" \\+ end","errorType":"exception","errorClass":"ReadException","httpStatus":null,"severity":"error","filePath":"play-services-basement/src/main/java/com/google/android/gms/common/internal/safeparcel/SafeParcelReader.java","lineNumber":65,"sourceCode":"        int i = readSize(parcel, header);\n        if (i != expectedSize)\n            throw new ReadException(\"Expected size \" + expectedSize + \" got \" + i + \" (0x\" + Integer.toHexString(i) + \")\", parcel);\n    }\n\n    @Deprecated\n    public static int readStart(Parcel parcel) {\n        return readObjectHeader(parcel);\n    }\n\n    public static int readObjectHeader(Parcel parcel) {\n        int header = readHeader(parcel);\n        int size = readSize(parcel, header);\n        int start = parcel.dataPosition();\n        if (getFieldId(header) != SafeParcelable.SAFE_PARCEL_OBJECT_MAGIC)\n            throw new ReadException(\"Expected object header. Got 0x\" + Integer.toHexString(header), parcel);\n        int end = start + size;\n        if ((end < start) || (end > parcel.dataSize()))\n            throw new ReadException(\"Size read is invalid start=\" + start + \" end=\" + end, parcel);\n        return end;\n    }\n\n    public static int readInt(Parcel parcel, int header) {\n        readExpectedSize(parcel, header, 4);\n        return parcel.readInt();\n    }\n\n    public static byte readByte(Parcel parcel, int header) {\n        readExpectedSize(parcel, header, 4);\n        return (byte) parcel.readInt();\n    }\n\n    public static short readShort(Parcel parcel, int header) {\n        readExpectedSize(parcel, header, 4);\n        return (short) parcel.readInt();\n    }\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/microg/GmsCore/blob/157c9d86ac46c195a86c2f15ab55c84036223f95/play-services-basement/src/main/java/com/google/android/gms/common/internal/safeparcel/SafeParcelReader.java#L47-L83","documentation":"SafeParcelReader.readObjectHeader validates the size field embedded in a SafeParcelable header: it computes end = start + size and throws a ReadException if end is negative (integer overflow) or beyond parcel.dataSize(). This guards against reading a corrupted or truncated Parcel that would otherwise cause out-of-bounds reads.","triggerScenarios":"Reading a Parcel written by a different version of the same Parcelable class; a Parcel corrupted in transit across processes; truncated Parcel data (end > dataSize) or a size field causing int overflow (end < start); hand-crafted or fuzzed Parcel bytes; Bundle/IBinder round-trips that dropped data.","commonSituations":"App A writes a Parcelable with an older play-services version and App B (or a different process) reads it with a newer format; intent extras survived serialization/deserialization incorrectly; byte-level manipulation or memory corruption of the Bundle.","solutions":["Ensure the same (or format-compatible) version of the play-services library is used on both the writing and reading sides","Re-create the Parcelable from its original source data instead of re-reading a suspect Parcel","Catch ReadException and fall back to defaults / re-request the data rather than crashing","If you own the Parcelable, bump CREATOR versioning and validate field count before reading"],"exampleFix":"// before\nint end = SafeParcelReader.readObjectHeader(parcel, header);\n// after\nint end;\ntry {\n    end = SafeParcelReader.readObjectHeader(parcel, header);\n} catch (SafeParcelReader.ReadException e) {\n    Log.w(TAG, \"Corrupt parcel header\", e);\n    end = -1; // bail out / use defaults\n}","handlingStrategy":"try-catch","validationCode":"// best-effort pre-check when you own the parcel\nif (parcel.dataSize() <= 0) { /* reject empty parcel */ }","typeGuard":null,"tryCatchPattern":"try {\n    int end = SafeParcelReader.readObjectHeader(parcel, header);\n} catch (SafeParcelReader.ReadException e) {\n    Log.w(TAG, \"Malformed SafeParcelable header\", e);\n    // abort parse / use defaults\n}","preventionTips":["Keep play-services library versions consistent across writer and reader processes","Never hand-edit or cache raw Parcel bytes across app versions","Validate Bundle contents after cross-process transport","Add version fields to custom Parcelables and branch on them in CREATOR"],"tags":["android","parcel","deserialization","version-compat"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"157c9d86ac46c195a86c2f15ab55c84036223f95","analyzedAt":"2026-09-06T17:27:33.892Z","contentChangedAt":"2026-09-06T17:27:33.892Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}