diff options
author | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-11-08 19:22:57 +0000 |
---|---|---|
committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-11-08 19:22:57 +0000 |
commit | 8f457e3230f1a4ce737f512ffbb5c919b8d02407 (patch) | |
tree | 1b6cb51813563c2960a4bc19562bb0c2185d89d8 /src/core/SkPath.cpp | |
parent | 9901727f213e459901a175c119b2fad8816002a0 (diff) |
Adding error checks to SkRBuffer
BUG=
R=robertphillips@google.com, bsalomon@google.com, reed@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/61913002
git-svn-id: http://skia.googlecode.com/svn/trunk@12202 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'src/core/SkPath.cpp')
-rw-r--r-- | src/core/SkPath.cpp | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp index e6d606c1b1..f772717e2f 100644 --- a/src/core/SkPath.cpp +++ b/src/core/SkPath.cpp @@ -2120,8 +2120,9 @@ size_t SkPath::writeToMemory(void* storage) const { (fSegmentMask << kSegmentMask_SerializationShift) | (fDirection << kDirection_SerializationShift) #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO - | (0x1 << kNewFormat_SerializationShift); + | (0x1 << kNewFormat_SerializationShift) #endif + ; buffer.write32(packed); @@ -2134,7 +2135,11 @@ size_t SkPath::writeToMemory(void* storage) const { size_t SkPath::readFromMemory(const void* storage, size_t length) { SkRBufferWithSizeCheck buffer(storage, length); - uint32_t packed = buffer.readS32(); + int32_t packed; + if (!buffer.readS32(&packed)) { + return 0; + } + fIsOval = (packed >> kIsOval_SerializationShift) & 1; fConvexity = (packed >> kConvexity_SerializationShift) & 0xFF; fFillType = (packed >> kFillType_SerializationShift) & 0xFF; @@ -2144,18 +2149,21 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) { bool newFormat = (packed >> kNewFormat_SerializationShift) & 1; #endif - fPathRef.reset(SkPathRef::CreateFromBuffer(&buffer + SkPathRef* pathRef = SkPathRef::CreateFromBuffer(&buffer #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO , newFormat, packed #endif - )); - - buffer.skipToAlign4(); + ); size_t sizeRead = 0; if (buffer.isValid()) { + fPathRef.reset(pathRef); SkDEBUGCODE(this->validate();) + buffer.skipToAlign4(); sizeRead = buffer.pos(); + } else if (NULL != pathRef) { + // If the buffer is not valid, pathRef should be NULL + sk_throw(); } return sizeRead; } |