AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Verify size_t overflow

Browse Source 
In 32 bits, it's possible that multiplying 2 32b values might overflow a size_t, which could be 32b unsigned in that context, so I added a check for size_t overflow.

BUG=445831

Review URL: https://codereview.chromium.org/836733005
This commit is contained in:
sugoi 2015-01-07 08:47:44 -08:00 committed by Commit bot
parent 36a364a846
commit bd0d9da981
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/core/SkBitmap.cpp
View File

@ -1202,16 +1202,17 @@ bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) {
}
const size_t ramRB = info.minRowBytes();
const int height = info.height();
const size_t snugSize = snugRB * height;
const size_t ramSize = ramRB * height;
if (!buffer->validate(snugSize <= ramSize)) {
const int height = SkMax32(info.height(), 0);
const uint64_t snugSize = sk_64_mul(snugRB, height);
const uint64_t ramSize = sk_64_mul(ramRB, height);
static const uint64_t max_size_t = (size_t)(-1);
if (!buffer->validate((snugSize <= ramSize) && (ramSize <= max_size_t))) {
return false;
}
SkAutoDataUnref data(SkData::NewUninitialized(ramSize));
SkAutoDataUnref data(SkData::NewUninitialized(SkToSizeT(ramSize)));
char* dst = (char*)data->writable_data();
buffer->readByteArray(dst, snugSize);
buffer->readByteArray(dst, SkToSizeT(snugSize));
if (snugSize != ramSize) {
const char* srcRow = dst + snugRB * (height - 1);