From 91c395af69cf10cd13062f143811a7a9a3ce03c7 Mon Sep 17 00:00:00 2001
From: senorblanco <senorblanco@chromium.org>
Date: Thu, 25 Sep 2014 15:51:35 -0700
Subject: [PATCH] Fix SkTableColorFilter deserialization validation.

Broken in https://skia.googlesource.com/skia/+/9fa60daad4d5f54c0dbe3dbcc7608a8f6d721187.

R=reed@google.com
TBR=reed@google.com

BUG=skia:

Author: senorblanco@chromium.org

Review URL: https://codereview.chromium.org/604873004
---
 src/effects/SkTableColorFilter.cpp |  2 +-
 tests/SerializationTest.cpp        | 18 +++++++++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/effects/SkTableColorFilter.cpp b/src/effects/SkTableColorFilter.cpp
index 88b4a4bf4b..4853f73e5c 100644
--- a/src/effects/SkTableColorFilter.cpp
+++ b/src/effects/SkTableColorFilter.cpp
@@ -198,7 +198,7 @@ SkFlattenable* SkTable_ColorFilter::CreateProc(SkReadBuffer& buffer) {
     uint8_t unpackedStorage[4*256];
     size_t unpackedSize = SkPackBits::Unpack8(packedStorage, packedSize, unpackedStorage);
     // now check that we got the size we expected
-    if (!buffer.validate(unpackedSize != count*256)) {
+    if (!buffer.validate(unpackedSize == count*256)) {
         return NULL;
     }
 
diff --git a/tests/SerializationTest.cpp b/tests/SerializationTest.cpp
index af146006e7..dd9b938d52 100644
--- a/tests/SerializationTest.cpp
+++ b/tests/SerializationTest.cpp
@@ -11,6 +11,7 @@
 #include "SkMallocPixelRef.h"
 #include "SkOSFile.h"
 #include "SkPictureRecorder.h"
+#include "SkTableColorFilter.h"
 #include "SkTemplates.h"
 #include "SkTypeface.h"
 #include "SkWriteBuffer.h"
@@ -177,7 +178,7 @@ static T* TestFlattenableSerialization(T* testObj, bool shouldSucceed,
     size_t bytesWritten = writer.bytesWritten();
     REPORTER_ASSERT(reporter, SkAlign4(bytesWritten) == bytesWritten);
 
-    unsigned char dataWritten[1024];
+    unsigned char dataWritten[4096];
     SkASSERT(bytesWritten <= sizeof(dataWritten));
     writer.writeToMemory(dataWritten);
 
@@ -274,6 +275,16 @@ static void TestXfermodeSerialization(skiatest::Reporter* reporter) {
     }
 }
 
+static void TestColorFilterSerialization(skiatest::Reporter* reporter) {
+    uint8_t table[256];
+    for (int i = 0; i < 256; ++i) {
+        table[i] = (i * 41) % 256;
+    }
+    SkAutoTUnref<SkColorFilter> colorFilter(SkTableColorFilter::Create(table));
+    SkAutoTUnref<SkColorFilter> copy(
+        TestFlattenableSerialization<SkColorFilter>(colorFilter.get(), true, reporter));
+}
+
 static SkBitmap draw_picture(SkPicture& picture) {
      SkBitmap bitmap;
      bitmap.allocN32Pixels(SkScalarCeilToInt(picture.cullRect().width()), 
@@ -424,6 +435,11 @@ DEF_TEST(Serialization, reporter) {
         TestXfermodeSerialization(reporter);
     }
 
+    // Test color filter serialization
+    {
+        TestColorFilterSerialization(reporter);
+    }
+
     // Test string serialization
     {
         SkString string("string");