diff options
| author |  Robert Phillips <robertphillips@google.com> | 2016-12-19 12:58:14 -0500 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2016-12-19 19:42:39 +0000 |
| commit | 20dd31fed5f63d7d97719ce7f53755fa94086cfd (patch) | |
| tree | aee51451f5332c4abf398a5134d9393f790196a5 /src/core/SkPictureData.cpp | |
| parent | d1c550e71fa72cfbf03b93c10ec8b9d1d109f8c2 (diff) | |
Guard some uint32_t -> int cases in SkPictureData reading
Change-Id: I67e6a67a57bf83922d159083e359df1a8ce053c1
Reviewed-on: https://skia-review.googlesource.com/6275
Reviewed-by: Herb Derby <herb@google.com>
Commit-Queue: Robert Phillips <robertphillips@google.com>
Diffstat (limited to 'src/core/SkPictureData.cpp')
| -rw-r--r-- | src/core/SkPictureData.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/core/SkPictureData.cpp b/src/core/SkPictureData.cpp index 5f9cb7180e..1aff1e46b9 100644 --- a/src/core/SkPictureData.cpp +++ b/src/core/SkPictureData.cpp @@ -485,6 +485,10 @@ bool new_array_from_buffer(SkReadBuffer& buffer, uint32_t inCount, if (0 == inCount) { return true; } + if (!buffer.validate(SkTFitsIn<int>(inCount))) { + return false; + } + *outCount = inCount; *array = new const T* [*outCount]; bool success = true; @@ -519,6 +523,9 @@ bool SkPictureData::parseBufferTag(SkReadBuffer& buffer, uint32_t tag, uint32_t } break; case SK_PICT_PAINT_BUFFER_TAG: { + if (!buffer.validate(SkTFitsIn<int>(size))) { + return false; + } const int count = SkToInt(size); fPaints.reset(count); for (int i = 0; i < count; ++i) { |