AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

SkGifCodec: do not write off the end of memory when repeatCount > 1

Browse Source 
BUG=skia:5887

GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=3940

Change-Id: I9e3ed6153a73277896ac067ef73918a41a0546b8
Reviewed-on: https://skia-review.googlesource.com/3940
Reviewed-by: Leon Scroggins <scroggo@google.com>
Commit-Queue: Matt Sarett <msarett@google.com>
This commit is contained in:
Matt Sarett 2016-10-25 14:24:50 -04:00 committed by Skia Commit-Bot
parent 8bce117ff7
commit 8a4e9c51f4
3 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
resources/invalid_images/skbug5887.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 280 B

4
src/codec/SkGifCodec.cpp
View File

@ -464,6 +464,10 @@ bool SkGifCodec::haveDecodedRow(size_t frameIndex, const unsigned char* rowBegin
if (!foundNecessaryRow) {
return true;
}
} else {
// Make sure the repeatCount does not take us beyond the end of the dst
SkASSERT(this->dstInfo().height() >= yBegin);
repeatCount = SkTMin(repeatCount, (unsigned) (this->dstInfo().height() - yBegin));
}
if (!fFilledBackground) {

13
tests/CodecTest.cpp
View File

@ -1429,9 +1429,14 @@ DEF_TEST(Codec_rowsDecoded, r) {
REPORTER_ASSERT(r, rowsDecoded == 0);
}
DEF_TEST(Codec_IcoIntOverflow, r) {
// ASAN will complain if there is an issue.
static void test_invalid_images(skiatest::Reporter* r, const char* path, bool shouldSucceed) {
SkBitmap bitmap;
const bool success = GetResourceAsBitmap("invalid_images/int_overflow.ico", &bitmap);
REPORTER_ASSERT(r, !success);
const bool success = GetResourceAsBitmap(path, &bitmap);
REPORTER_ASSERT(r, success == shouldSucceed);
}
DEF_TEST(Codec_InvalidImages, r) {
// ASAN will complain if there is an issue.
test_invalid_images(r, "invalid_images/int_overflow.ico", false);
test_invalid_images(r, "invalid_images/skbug5887.gif", true);
}