Replace BMP calls to new with calls to malloc

A BMP can have an arbitrarily large width. We typically read a row
into a block of memory before swizzling it to the output. Rather
than calling new to create that block of memory, which may crash
when we run out of memory, call malloc, and return null if malloc
fails.

Add a common base class for Mask and Standard BMP codecs. This class
handles allocating and freeing the buffer.

Bug: b/37623797
Change-Id: I0510b76d688d030865faa481bb2fb1351dac2c97
Reviewed-on: https://skia-review.googlesource.com/18400
Reviewed-by: Matt Sarett <msarett@google.com>
Commit-Queue: Leon Scroggins <scroggo@google.com>

1 files changed, 5 insertions, 6 deletions

diff --git a/src/codec/SkBmpStandardCodec.cpp b/src/codec/SkBmpStandardCodec.cpp
index a0ad7875eb..c223678769 100644
--- a/src/codec/SkBmpStandardCodec.cpp
+++ b/src/codec/SkBmpStandardCodec.cpp
@@ -25,7 +25,6 @@ SkBmpStandardCodec::SkBmpStandardCodec(int width, int height, const SkEncodedInf
     , fBytesPerColor(bytesPerColor)
     , fOffset(offset)
     , fSwizzler(nullptr)
-    , fSrcBuffer(new uint8_t[this->srcRowBytes()])
     , fIsOpaque(isOpaque)
     , fInIco(inIco)
     , fAndMaskRowBytes(fInIco ? SkAlign4(compute_row_bytes(this->getInfo().width(), 1)) : 0)
@@ -231,7 +230,7 @@ int SkBmpStandardCodec::decodeRows(const SkImageInfo& dstInfo, void* dst, size_t
     const int height = dstInfo.height();
     for (int y = 0; y < height; y++) {
         // Read a row of the input
-        if (this->stream()->read(fSrcBuffer.get(), this->srcRowBytes()) != this->srcRowBytes()) {
+        if (this->stream()->read(this->srcBuffer(), this->srcRowBytes()) != this->srcRowBytes()) {
             SkCodecPrintf("Warning: incomplete input stream.\n");
             return y;
         }
@@ -244,10 +243,10 @@ int SkBmpStandardCodec::decodeRows(const SkImageInfo& dstInfo, void* dst, size_t
         if (fXformOnDecode) {
             SkASSERT(this->colorXform());
             SkImageInfo xformInfo = dstInfo.makeWH(fSwizzler->swizzleWidth(), dstInfo.height());
-            fSwizzler->swizzle(this->xformBuffer(), fSrcBuffer.get());
+            fSwizzler->swizzle(this->xformBuffer(), this->srcBuffer());
             this->applyColorXform(xformInfo, dstRow, this->xformBuffer());
         } else {
-            fSwizzler->swizzle(dstRow, fSrcBuffer.get());
+            fSwizzler->swizzle(dstRow, this->srcBuffer());
         }
     }
 
@@ -321,7 +320,7 @@ void SkBmpStandardCodec::decodeIcoMask(SkStream* stream, const SkImageInfo& dstI
     SkPMColor* dstPtr = (SkPMColor*) dst;
     for (int y = 0; y < dstInfo.height(); y++) {
         // The srcBuffer will at least be large enough
-        if (stream->read(fSrcBuffer.get(), fAndMaskRowBytes) != fAndMaskRowBytes) {
+        if (stream->read(this->srcBuffer(), fAndMaskRowBytes) != fAndMaskRowBytes) {
             SkCodecPrintf("Warning: incomplete AND mask for bmp-in-ico.\n");
             return;
         }
@@ -346,7 +345,7 @@ void SkBmpStandardCodec::decodeIcoMask(SkStream* stream, const SkImageInfo& dstI
             int modulus;
             SkTDivMod(srcX, 8, &quotient, &modulus);
             uint32_t shift = 7 - modulus;
-            uint64_t alphaBit = (fSrcBuffer.get()[quotient] >> shift) & 0x1;
+            uint64_t alphaBit = (this->srcBuffer()[quotient] >> shift) & 0x1;
             applyMask(dstRow, dstX, alphaBit);
             srcX += sampleX;
         }