AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Adding check on input count

Browse Source 
An integer overflow is causing a memory allocation to succeed while it should fail for being too large.

BUG=445810

Review URL: https://codereview.chromium.org/831583004
This commit is contained in:
sugoi 2015-01-07 13:28:08 -08:00 committed by Commit bot
parent a7976be1dd
commit 23d432080c
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/core/SkTemplates.h
View File

@ -10,6 +10,7 @@
#ifndef SkTemplates_DEFINED
#define SkTemplates_DEFINED
#include "SkMath.h"
#include "SkTypes.h"
#include <limits.h>
#include <new>
@ -292,7 +293,12 @@ public:
}
if (count > N) {
fArray = (T*) sk_malloc_throw(count * sizeof(T));
const uint64_t size64 = sk_64_mul(count, sizeof(T));
const size_t size = static_cast<size_t>(size64);
if (size != size64) {
sk_out_of_memory();
}
fArray = (T*) sk_malloc_throw(size);
} else if (count > 0) {
fArray = (T*) fStorage;
} else {