diff options
| author |  benjaminwagner <benjaminwagner@google.com> | 2015-12-04 08:48:26 -0800 |
|---|---|---|
| committer |  Commit bot <commit-bot@chromium.org> | 2015-12-04 08:48:26 -0800 |
| commit | 886e5e41db5d6d42368f225785013c9308dc66bc (patch) | |
| tree | e168d7240ec06966d6469f5821e38b537e45bb71 /src/codec/SkBmpStandardCodec.cpp | |
| parent | be8216a922241cc8f3ea3b813608fcb06936fde0 (diff) | |
Fix overflow caught by ASAN.
BUG=skia:
Review URL: https://codereview.chromium.org/1498923002
Diffstat (limited to 'src/codec/SkBmpStandardCodec.cpp')
| -rw-r--r-- | src/codec/SkBmpStandardCodec.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/codec/SkBmpStandardCodec.cpp b/src/codec/SkBmpStandardCodec.cpp index 5bbdcd25e2..85b40778b6 100644 --- a/src/codec/SkBmpStandardCodec.cpp +++ b/src/codec/SkBmpStandardCodec.cpp @@ -20,7 +20,7 @@ SkBmpStandardCodec::SkBmpStandardCodec(const SkImageInfo& info, SkStream* stream SkCodec::SkScanlineOrder rowOrder, bool inIco) : INHERITED(info, stream, bitsPerPixel, rowOrder) , fColorTable(nullptr) - , fNumColors(this->computeNumColors(numColors)) + , fNumColors(numColors) , fBytesPerColor(bytesPerColor) , fOffset(offset) , fSwizzler(nullptr) @@ -80,9 +80,12 @@ SkCodec::Result SkBmpStandardCodec::onGetPixels(const SkImageInfo& dstInfo, // access memory outside of our color table array. *numColors = maxColors; } + // Don't bother reading more than maxColors. + const uint32_t numColorsToRead = + fNumColors == 0 ? maxColors : SkTMin(fNumColors, maxColors); // Read the color table from the stream - colorBytes = fNumColors * fBytesPerColor; + colorBytes = numColorsToRead * fBytesPerColor; SkAutoTDeleteArray<uint8_t> cBuffer(new uint8_t[colorBytes]); if (stream()->read(cBuffer.get(), colorBytes) != colorBytes) { SkCodecPrintf("Error: unable to read color table.\n"); @@ -110,7 +113,7 @@ SkCodec::Result SkBmpStandardCodec::onGetPixels(const SkImageInfo& dstInfo, // Fill in the color table uint32_t i = 0; - for (; i < fNumColors; i++) { + for (; i < numColorsToRead; i++) { uint8_t blue = get_byte(cBuffer.get(), i*fBytesPerColor); uint8_t green = get_byte(cBuffer.get(), i*fBytesPerColor + 1); uint8_t red = get_byte(cBuffer.get(), i*fBytesPerColor + 2); |