Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
/*
|
|
|
|
* Copyright 2013 Google Inc.
|
|
|
|
*
|
|
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
|
|
* found in the LICENSE file.
|
|
|
|
*/
|
|
|
|
|
2013-12-12 21:11:12 +00:00
|
|
|
#include "Test.h"
|
|
|
|
#include "TestClassDef.h"
|
2013-12-04 17:06:49 +00:00
|
|
|
#include "SkBitmapDevice.h"
|
|
|
|
#include "SkBitmapSource.h"
|
|
|
|
#include "SkCanvas.h"
|
|
|
|
#include "SkMallocPixelRef.h"
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
#include "SkOrderedWriteBuffer.h"
|
|
|
|
#include "SkValidatingReadBuffer.h"
|
2013-12-04 17:06:49 +00:00
|
|
|
#include "SkXfermodeImageFilter.h"
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
static const uint32_t kArraySize = 64;
|
|
|
|
|
|
|
|
template<typename T>
|
|
|
|
static void TestAlignment(T* testObj, skiatest::Reporter* reporter) {
|
|
|
|
// Test memory read/write functions directly
|
|
|
|
unsigned char dataWritten[1024];
|
|
|
|
size_t bytesWrittenToMemory = testObj->writeToMemory(dataWritten);
|
|
|
|
REPORTER_ASSERT(reporter, SkAlign4(bytesWrittenToMemory) == bytesWrittenToMemory);
|
|
|
|
size_t bytesReadFromMemory = testObj->readFromMemory(dataWritten, bytesWrittenToMemory);
|
|
|
|
REPORTER_ASSERT(reporter, SkAlign4(bytesReadFromMemory) == bytesReadFromMemory);
|
|
|
|
}
|
2013-11-04 16:18:15 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<typename T> struct SerializationUtils {
|
2013-12-04 17:06:49 +00:00
|
|
|
// Generic case for flattenables
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, const T* flattenable) {
|
|
|
|
writer.writeFlattenable(flattenable);
|
|
|
|
}
|
|
|
|
static void Read(SkValidatingReadBuffer& reader, T** flattenable) {
|
|
|
|
*flattenable = (T*)reader.readFlattenable(T::GetFlattenableType());
|
|
|
|
}
|
2013-11-05 15:46:56 +00:00
|
|
|
};
|
2013-11-04 16:18:15 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<SkMatrix> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, const SkMatrix* matrix) {
|
|
|
|
writer.writeMatrix(*matrix);
|
|
|
|
}
|
|
|
|
static void Read(SkValidatingReadBuffer& reader, SkMatrix* matrix) {
|
|
|
|
reader.readMatrix(matrix);
|
|
|
|
}
|
|
|
|
};
|
2013-11-04 20:28:23 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<SkPath> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, const SkPath* path) {
|
|
|
|
writer.writePath(*path);
|
2013-11-04 20:28:23 +00:00
|
|
|
}
|
2013-11-05 15:46:56 +00:00
|
|
|
static void Read(SkValidatingReadBuffer& reader, SkPath* path) {
|
|
|
|
reader.readPath(path);
|
|
|
|
}
|
|
|
|
};
|
2013-11-04 20:28:23 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<SkRegion> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, const SkRegion* region) {
|
|
|
|
writer.writeRegion(*region);
|
|
|
|
}
|
|
|
|
static void Read(SkValidatingReadBuffer& reader, SkRegion* region) {
|
|
|
|
reader.readRegion(region);
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
template<> struct SerializationUtils<unsigned char> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, unsigned char* data, uint32_t arraySize) {
|
|
|
|
writer.writeByteArray(data, arraySize);
|
|
|
|
}
|
|
|
|
static bool Read(SkValidatingReadBuffer& reader, unsigned char* data, uint32_t arraySize) {
|
|
|
|
return reader.readByteArray(data, arraySize);
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
template<> struct SerializationUtils<SkColor> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, SkColor* data, uint32_t arraySize) {
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
writer.writeColorArray(data, arraySize);
|
2013-11-05 15:46:56 +00:00
|
|
|
}
|
|
|
|
static bool Read(SkValidatingReadBuffer& reader, SkColor* data, uint32_t arraySize) {
|
|
|
|
return reader.readColorArray(data, arraySize);
|
|
|
|
}
|
|
|
|
};
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<int32_t> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, int32_t* data, uint32_t arraySize) {
|
|
|
|
writer.writeIntArray(data, arraySize);
|
|
|
|
}
|
|
|
|
static bool Read(SkValidatingReadBuffer& reader, int32_t* data, uint32_t arraySize) {
|
|
|
|
return reader.readIntArray(data, arraySize);
|
|
|
|
}
|
|
|
|
};
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<SkPoint> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, SkPoint* data, uint32_t arraySize) {
|
|
|
|
writer.writePointArray(data, arraySize);
|
|
|
|
}
|
|
|
|
static bool Read(SkValidatingReadBuffer& reader, SkPoint* data, uint32_t arraySize) {
|
|
|
|
return reader.readPointArray(data, arraySize);
|
|
|
|
}
|
|
|
|
};
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<> struct SerializationUtils<SkScalar> {
|
|
|
|
static void Write(SkOrderedWriteBuffer& writer, SkScalar* data, uint32_t arraySize) {
|
|
|
|
writer.writeScalarArray(data, arraySize);
|
|
|
|
}
|
|
|
|
static bool Read(SkValidatingReadBuffer& reader, SkScalar* data, uint32_t arraySize) {
|
|
|
|
return reader.readScalarArray(data, arraySize);
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
}
|
2013-11-05 15:46:56 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
template<typename T>
|
|
|
|
static void TestObjectSerialization(T* testObj, skiatest::Reporter* reporter) {
|
|
|
|
SkOrderedWriteBuffer writer(1024);
|
|
|
|
writer.setFlags(SkOrderedWriteBuffer::kValidation_Flag);
|
|
|
|
SerializationUtils<T>::Write(writer, testObj);
|
|
|
|
size_t bytesWritten = writer.bytesWritten();
|
|
|
|
REPORTER_ASSERT(reporter, SkAlign4(bytesWritten) == bytesWritten);
|
|
|
|
|
|
|
|
unsigned char dataWritten[1024];
|
|
|
|
writer.writeToMemory(dataWritten);
|
|
|
|
|
|
|
|
// Make sure this fails when it should (test with smaller size, but still multiple of 4)
|
|
|
|
SkValidatingReadBuffer buffer(dataWritten, bytesWritten - 4);
|
2013-11-08 19:22:57 +00:00
|
|
|
T obj;
|
|
|
|
SerializationUtils<T>::Read(buffer, &obj);
|
2013-12-06 20:14:46 +00:00
|
|
|
REPORTER_ASSERT(reporter, !buffer.isValid());
|
2013-11-05 15:46:56 +00:00
|
|
|
|
|
|
|
// Make sure this succeeds when it should
|
|
|
|
SkValidatingReadBuffer buffer2(dataWritten, bytesWritten);
|
2013-11-08 19:22:57 +00:00
|
|
|
const unsigned char* peekBefore = static_cast<const unsigned char*>(buffer2.skip(0));
|
|
|
|
T obj2;
|
|
|
|
SerializationUtils<T>::Read(buffer2, &obj2);
|
|
|
|
const unsigned char* peekAfter = static_cast<const unsigned char*>(buffer2.skip(0));
|
2013-11-05 15:46:56 +00:00
|
|
|
// This should have succeeded, since there are enough bytes to read this
|
2013-12-06 20:14:46 +00:00
|
|
|
REPORTER_ASSERT(reporter, buffer2.isValid());
|
2013-11-05 15:46:56 +00:00
|
|
|
REPORTER_ASSERT(reporter, static_cast<size_t>(peekAfter - peekBefore) == bytesWritten);
|
|
|
|
|
|
|
|
TestAlignment(testObj, reporter);
|
|
|
|
}
|
|
|
|
|
2013-12-04 17:06:49 +00:00
|
|
|
template<typename T>
|
|
|
|
static T* TestFlattenableSerialization(T* testObj, bool shouldSucceed,
|
|
|
|
skiatest::Reporter* reporter) {
|
|
|
|
SkOrderedWriteBuffer writer(1024);
|
|
|
|
writer.setFlags(SkOrderedWriteBuffer::kValidation_Flag);
|
|
|
|
SerializationUtils<T>::Write(writer, testObj);
|
|
|
|
size_t bytesWritten = writer.bytesWritten();
|
|
|
|
REPORTER_ASSERT(reporter, SkAlign4(bytesWritten) == bytesWritten);
|
|
|
|
|
|
|
|
unsigned char dataWritten[1024];
|
|
|
|
writer.writeToMemory(dataWritten);
|
|
|
|
|
|
|
|
// Make sure this fails when it should (test with smaller size, but still multiple of 4)
|
|
|
|
SkValidatingReadBuffer buffer(dataWritten, bytesWritten - 4);
|
|
|
|
T* obj = NULL;
|
|
|
|
SerializationUtils<T>::Read(buffer, &obj);
|
2013-12-06 20:14:46 +00:00
|
|
|
REPORTER_ASSERT(reporter, !buffer.isValid());
|
2013-12-04 17:06:49 +00:00
|
|
|
REPORTER_ASSERT(reporter, NULL == obj);
|
|
|
|
|
|
|
|
// Make sure this succeeds when it should
|
|
|
|
SkValidatingReadBuffer buffer2(dataWritten, bytesWritten);
|
|
|
|
const unsigned char* peekBefore = static_cast<const unsigned char*>(buffer2.skip(0));
|
|
|
|
T* obj2 = NULL;
|
|
|
|
SerializationUtils<T>::Read(buffer2, &obj2);
|
|
|
|
const unsigned char* peekAfter = static_cast<const unsigned char*>(buffer2.skip(0));
|
|
|
|
if (shouldSucceed) {
|
|
|
|
// This should have succeeded, since there are enough bytes to read this
|
2013-12-06 20:14:46 +00:00
|
|
|
REPORTER_ASSERT(reporter, buffer2.isValid());
|
2013-12-04 17:06:49 +00:00
|
|
|
REPORTER_ASSERT(reporter, static_cast<size_t>(peekAfter - peekBefore) == bytesWritten);
|
|
|
|
REPORTER_ASSERT(reporter, NULL != obj2);
|
|
|
|
} else {
|
|
|
|
// If the deserialization was supposed to fail, make sure it did
|
2013-12-06 20:14:46 +00:00
|
|
|
REPORTER_ASSERT(reporter, !buffer.isValid());
|
2013-12-04 17:06:49 +00:00
|
|
|
REPORTER_ASSERT(reporter, NULL == obj2);
|
|
|
|
}
|
|
|
|
|
|
|
|
return obj2; // Return object to perform further validity tests on it
|
|
|
|
}
|
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
template<typename T>
|
|
|
|
static void TestArraySerialization(T* data, skiatest::Reporter* reporter) {
|
|
|
|
SkOrderedWriteBuffer writer(1024);
|
|
|
|
writer.setFlags(SkOrderedWriteBuffer::kValidation_Flag);
|
|
|
|
SerializationUtils<T>::Write(writer, data, kArraySize);
|
|
|
|
size_t bytesWritten = writer.bytesWritten();
|
|
|
|
// This should write the length (in 4 bytes) and the array
|
|
|
|
REPORTER_ASSERT(reporter, (4 + kArraySize * sizeof(T)) == bytesWritten);
|
|
|
|
|
|
|
|
unsigned char dataWritten[1024];
|
|
|
|
writer.writeToMemory(dataWritten);
|
|
|
|
|
|
|
|
// Make sure this fails when it should
|
|
|
|
SkValidatingReadBuffer buffer(dataWritten, bytesWritten);
|
|
|
|
T dataRead[kArraySize];
|
|
|
|
bool success = SerializationUtils<T>::Read(buffer, dataRead, kArraySize / 2);
|
|
|
|
// This should have failed, since the provided size was too small
|
|
|
|
REPORTER_ASSERT(reporter, !success);
|
|
|
|
|
|
|
|
// Make sure this succeeds when it should
|
|
|
|
SkValidatingReadBuffer buffer2(dataWritten, bytesWritten);
|
|
|
|
success = SerializationUtils<T>::Read(buffer2, dataRead, kArraySize);
|
|
|
|
// This should have succeeded, since there are enough bytes to read this
|
|
|
|
REPORTER_ASSERT(reporter, success);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-12-04 17:06:49 +00:00
|
|
|
static void TestBitmapSerialization(const SkBitmap& validBitmap,
|
|
|
|
const SkBitmap& invalidBitmap,
|
|
|
|
bool shouldSucceed,
|
|
|
|
skiatest::Reporter* reporter) {
|
|
|
|
SkBitmapSource validBitmapSource(validBitmap);
|
|
|
|
SkBitmapSource invalidBitmapSource(invalidBitmap);
|
|
|
|
SkAutoTUnref<SkXfermode> mode(SkXfermode::Create(SkXfermode::kSrcOver_Mode));
|
|
|
|
SkXfermodeImageFilter xfermodeImageFilter(mode, &invalidBitmapSource, &validBitmapSource);
|
|
|
|
|
|
|
|
SkAutoTUnref<SkImageFilter> deserializedFilter(
|
|
|
|
TestFlattenableSerialization<SkImageFilter>(
|
|
|
|
&xfermodeImageFilter, shouldSucceed, reporter));
|
|
|
|
|
|
|
|
// Try to render a small bitmap using the invalid deserialized filter
|
|
|
|
// to make sure we don't crash while trying to render it
|
|
|
|
if (shouldSucceed) {
|
|
|
|
SkBitmap bitmap;
|
|
|
|
bitmap.setConfig(SkBitmap::kARGB_8888_Config, 24, 24);
|
|
|
|
bitmap.allocPixels();
|
|
|
|
SkBitmapDevice device(bitmap);
|
|
|
|
SkCanvas canvas(&device);
|
|
|
|
canvas.clear(0x00000000);
|
|
|
|
SkPaint paint;
|
|
|
|
paint.setImageFilter(deserializedFilter);
|
|
|
|
canvas.clipRect(SkRect::MakeXYWH(0, 0, SkIntToScalar(24), SkIntToScalar(24)));
|
|
|
|
canvas.drawBitmap(bitmap, 0, 0, &paint);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-12-12 21:11:12 +00:00
|
|
|
DEF_TEST(Serialization, reporter) {
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test matrix serialization
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
{
|
2013-11-05 15:46:56 +00:00
|
|
|
SkMatrix matrix = SkMatrix::I();
|
|
|
|
TestObjectSerialization(&matrix, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test path serialization
|
|
|
|
{
|
|
|
|
SkPath path;
|
|
|
|
TestObjectSerialization(&path, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test region serialization
|
|
|
|
{
|
|
|
|
SkRegion region;
|
|
|
|
TestObjectSerialization(®ion, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test rrect serialization
|
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
// SkRRect does not initialize anything.
|
|
|
|
// An uninitialized SkRRect can be serialized,
|
|
|
|
// but will branch on uninitialized data when deserialized.
|
2013-11-05 15:46:56 +00:00
|
|
|
SkRRect rrect;
|
2013-12-02 13:50:38 +00:00
|
|
|
SkRect rect = SkRect::MakeXYWH(1, 2, 20, 30);
|
|
|
|
SkVector corners[4] = { {1, 2}, {2, 3}, {3,4}, {4,5} };
|
|
|
|
rrect.setRectRadii(rect, corners);
|
2013-11-05 15:46:56 +00:00
|
|
|
TestAlignment(&rrect, reporter);
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
}
|
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test readByteArray
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
unsigned char data[kArraySize] = { 1, 2, 3 };
|
2013-11-05 15:46:56 +00:00
|
|
|
TestArraySerialization(data, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test readColorArray
|
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
SkColor data[kArraySize] = { SK_ColorBLACK, SK_ColorWHITE, SK_ColorRED };
|
2013-11-05 15:46:56 +00:00
|
|
|
TestArraySerialization(data, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test readIntArray
|
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
int32_t data[kArraySize] = { 1, 2, 4, 8 };
|
2013-11-05 15:46:56 +00:00
|
|
|
TestArraySerialization(data, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test readPointArray
|
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
SkPoint data[kArraySize] = { {6, 7}, {42, 128} };
|
2013-11-05 15:46:56 +00:00
|
|
|
TestArraySerialization(data, reporter);
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
}
|
|
|
|
|
2013-11-05 15:46:56 +00:00
|
|
|
// Test readScalarArray
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
{
|
2013-12-02 13:50:38 +00:00
|
|
|
SkScalar data[kArraySize] = { SK_Scalar1, SK_ScalarHalf, SK_ScalarMax };
|
2013-11-05 15:46:56 +00:00
|
|
|
TestArraySerialization(data, reporter);
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
}
|
2013-12-04 17:06:49 +00:00
|
|
|
|
|
|
|
// Test invalid deserializations
|
|
|
|
{
|
|
|
|
SkBitmap validBitmap;
|
|
|
|
validBitmap.setConfig(SkBitmap::kARGB_8888_Config, 256, 256);
|
|
|
|
|
|
|
|
// Create a bitmap with a really large height
|
|
|
|
SkBitmap invalidBitmap;
|
|
|
|
invalidBitmap.setConfig(SkBitmap::kARGB_8888_Config, 256, 1000000000);
|
|
|
|
|
|
|
|
// The deserialization should succeed, and the rendering shouldn't crash,
|
|
|
|
// even when the device fails to initialize, due to its size
|
|
|
|
TestBitmapSerialization(validBitmap, invalidBitmap, true, reporter);
|
|
|
|
|
|
|
|
// Create a bitmap with a pixel ref too small
|
|
|
|
SkBitmap invalidBitmap2;
|
2013-12-13 15:24:37 +00:00
|
|
|
invalidBitmap2.setConfig(SkBitmap::kARGB_8888_Config, 256, 256);
|
|
|
|
invalidBitmap2.setPixelRef(SkNEW_ARGS(SkMallocPixelRef,
|
|
|
|
(NULL, 256, NULL)))->unref();
|
2013-12-05 07:02:16 +00:00
|
|
|
|
2013-12-04 17:06:49 +00:00
|
|
|
// The deserialization should detect the pixel ref being too small and fail
|
|
|
|
TestBitmapSerialization(validBitmap, invalidBitmap2, false, reporter);
|
|
|
|
}
|
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
2013-10-31 18:37:50 +00:00
|
|
|
}
|