AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Guard some uint32_t -> int cases in SkPictureData reading

Browse Source 
Change-Id: I67e6a67a57bf83922d159083e359df1a8ce053c1
Reviewed-on: https://skia-review.googlesource.com/6275
Reviewed-by: Herb Derby <herb@google.com>
Commit-Queue: Robert Phillips <robertphillips@google.com>
This commit is contained in:
Robert Phillips 2016-12-19 12:58:14 -05:00 committed by Skia Commit-Bot
parent d1c550e71f
commit 20dd31fed5
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/core/SkPictureData.cpp
View File

@ -485,6 +485,10 @@ bool new_array_from_buffer(SkReadBuffer& buffer, uint32_t inCount,
if (0 == inCount) {
return true;
}
if (!buffer.validate(SkTFitsIn<int>(inCount))) {
return false;
}
*outCount = inCount;
*array = new const T* [*outCount];
bool success = true;
@ -519,6 +523,9 @@ bool SkPictureData::parseBufferTag(SkReadBuffer& buffer, uint32_t tag, uint32_t
}
break;
case SK_PICT_PAINT_BUFFER_TAG: {
if (!buffer.validate(SkTFitsIn<int>(size))) {
return false;
}
const int count = SkToInt(size);
fPaints.reset(count);
for (int i = 0; i < count; ++i) {