aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core/SkRegion.cpp
diff options
context:
space:
mode:
authorGravatar sugoi@google.com <sugoi@google.com@2bbb7eff-a529-9590-31e7-b0007b416f81>2013-11-04 20:28:23 +0000
committerGravatar sugoi@google.com <sugoi@google.com@2bbb7eff-a529-9590-31e7-b0007b416f81>2013-11-04 20:28:23 +0000
commitb48a59ae81a35642fe715a5cdd6fd758b652bff3 (patch)
tree4f901dda30343d1bf1ec06e97abeb8a3f384ed20 /src/core/SkRegion.cpp
parentac9d306a92e569e85a7611e9db00943b5b551f1e (diff)
Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.
BUG= R=reed@google.com Committed: https://code.google.com/p/skia/source/detail?r=12114 Review URL: https://codereview.chromium.org/41253002 git-svn-id: http://skia.googlecode.com/svn/trunk@12119 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'src/core/SkRegion.cpp')
-rw-r--r--src/core/SkRegion.cpp22
1 files changed, 13 insertions, 9 deletions
diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
index 02994bffb0..468be67154 100644
--- a/src/core/SkRegion.cpp
+++ b/src/core/SkRegion.cpp
@@ -1100,9 +1100,9 @@ bool SkRegion::op(const SkRegion& rgna, const SkRegion& rgnb, Op op) {
#include "SkBuffer.h"
-uint32_t SkRegion::writeToMemory(void* storage) const {
+size_t SkRegion::writeToMemory(void* storage) const {
if (NULL == storage) {
- uint32_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
+ size_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
if (!this->isEmpty()) {
size += sizeof(fBounds);
if (this->isComplex()) {
@@ -1133,11 +1133,11 @@ uint32_t SkRegion::writeToMemory(void* storage) const {
return buffer.pos();
}
-uint32_t SkRegion::readFromMemory(const void* storage) {
- SkRBuffer buffer(storage);
- SkRegion tmp;
- int32_t count;
-
+size_t SkRegion::readFromMemory(const void* storage, size_t length) {
+ SkRBufferWithSizeCheck buffer(storage, length);
+ SkRegion tmp;
+ int32_t count;
+
count = buffer.readS32();
if (count >= 0) {
buffer.read(&tmp.fBounds, sizeof(tmp.fBounds));
@@ -1150,8 +1150,12 @@ uint32_t SkRegion::readFromMemory(const void* storage) {
buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
}
}
- this->swap(tmp);
- return buffer.pos();
+ size_t sizeRead = 0;
+ if (buffer.isValid()) {
+ this->swap(tmp);
+ sizeRead = buffer.pos();
+ }
+ return sizeRead;
}
///////////////////////////////////////////////////////////////////////////////