diff --git a/src/gpu/ganesh/text/GrTextBlob.cpp b/src/gpu/ganesh/text/GrTextBlob.cpp index 138875c518..033967c22a 100644 --- a/src/gpu/ganesh/text/GrTextBlob.cpp +++ b/src/gpu/ganesh/text/GrTextBlob.cpp @@ -247,8 +247,11 @@ static bool check_glyph_count(SkReadBuffer& buffer, int glyphCount) { std::optional TransformedMaskVertexFiller::MakeFromBuffer( SkReadBuffer& buffer, GrSubRunAllocator* alloc) { - GrMaskFormat maskType = (GrMaskFormat)buffer.readInt(); - if (!buffer.validate(maskType < kMaskFormatCount)) { return {}; } + int checkingMaskType = buffer.readInt(); + if (!buffer.validate(0 <= checkingMaskType && checkingMaskType < kMaskFormatCount)) { + return {}; + } + GrMaskFormat maskType = (GrMaskFormat)checkingMaskType; int dstPadding = buffer.readInt(); if (!buffer.validate(0 <= dstPadding && dstPadding <= 2)) { return {}; } SkScalar strikeToSourceScale = buffer.readScalar();