diff options
| author |  commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-12-17 20:49:46 +0000 |
|---|---|---|
| committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-12-17 20:49:46 +0000 |
| commit | ef74fa189b738e13295d6a96f86a6e10223505a8 (patch) | |
| tree | 3434cb996555b725b71a520a93c8781923bc04ec /src/core/SkColorTable.cpp | |
| parent | 7d0b6131918c1b8d458a95f6b5e79f92f958b78f (diff) | |
Fixed more fuzzer issues
- Added the "isAvailable" function to check how much bytes are remaining in the stream before doing potentially large mallocs. That way, we can signal a bad stream instead of crashing.
- Added data validation in SkImageInfo.cpp
- Added NULL pointer check in displacement
- Modified the fuzzer for randomized bitmap types
BUG=328934,329254
R=senorblanco@google.com, senorblanco@chromium.org, reed@google.com, sugoi@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/116773002
git-svn-id: http://skia.googlecode.com/svn/trunk@12723 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'src/core/SkColorTable.cpp')
| -rw-r--r-- | src/core/SkColorTable.cpp | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/core/SkColorTable.cpp b/src/core/SkColorTable.cpp index c719defe86..12ec43ec98 100644 --- a/src/core/SkColorTable.cpp +++ b/src/core/SkColorTable.cpp @@ -90,8 +90,15 @@ SkColorTable::SkColorTable(SkFlattenableReadBuffer& buffer) { fAlphaType = SkToU8(buffer.readUInt()); fCount = buffer.getArrayCount(); - fColors = (SkPMColor*)sk_malloc_throw(fCount * sizeof(SkPMColor)); - SkDEBUGCODE(bool success =) buffer.readColorArray(fColors, fCount); + size_t allocSize = fCount * sizeof(SkPMColor); + SkDEBUGCODE(bool success = false;) + if (buffer.validateAvailable(allocSize)) { + fColors = (SkPMColor*)sk_malloc_throw(allocSize); + SkDEBUGCODE(success =) buffer.readColorArray(fColors, fCount); + } else { + fCount = 0; + fColors = NULL; + } #ifdef SK_DEBUG SkASSERT((unsigned)fCount <= 256); SkASSERT(success); |