diff options
| author |  commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2014-04-29 15:35:23 +0000 |
|---|---|---|
| committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2014-04-29 15:35:23 +0000 |
| commit | 1ac99c890b8afe957385a7625fd3b759f31be249 (patch) | |
| tree | 9630eb86ccd29fc6e9e83590dd8ea02838b3e9e4 /include | |
| parent | 705b1ff617ffe672e65d53bcaf3b690e8bb6b025 (diff) | |
Fixed issue found by clusterfuzz
An integer overflow was causing an issue when reading a string with a very large (or negative) size.
BUG=367764
R=senorblanco@google.com, senorblanco@chromium.org, reed@google.com, borenet@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/255693003
git-svn-id: http://skia.googlecode.com/svn/trunk@14434 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'include')
| -rw-r--r-- | include/core/SkReader32.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/core/SkReader32.h b/include/core/SkReader32.h index 7e8038d0ae..51e28ef146 100644 --- a/include/core/SkReader32.h +++ b/include/core/SkReader32.h @@ -40,7 +40,7 @@ public: const void* peek() const { return fCurr; } size_t available() const { return fStop - fCurr; } - bool isAvailable(size_t size) const { return fCurr + size <= fStop; } + bool isAvailable(size_t size) const { return size <= this->available(); } void rewind() { fCurr = fBase; } |