diff options
| author |  senorblanco <senorblanco@chromium.org> | 2016-05-06 08:48:57 -0700 |
|---|---|---|
| committer |  Commit bot <commit-bot@chromium.org> | 2016-05-06 08:48:57 -0700 |
| commit | 675576f023c8fa10cdb0c18bc0a6c214e0bab069 (patch) | |
| tree | 1a66f10f92a45de77e8a84f111574b6bad1f8df8 /src/core | |
| parent | bad1abc748a4a7cd4863803e1c90ac0769a98d0a (diff) | |
Detect an invalid intervalCount in SkRegion during deserialiation.
BUG=609260
GOLD_TRYBOT_URL= https://gold.skia.org/search2?unt=true&query=source_type%3Dgm&master=false&issue=1961463003
Review-Url: https://codereview.chromium.org/1961463003
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/SkRegion.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp index 38d12d2f5d..a50425afd8 100644 --- a/src/core/SkRegion.cpp +++ b/src/core/SkRegion.cpp @@ -1136,7 +1136,8 @@ size_t SkRegion::readFromMemory(const void* storage, size_t length) { tmp.fRunHead = SkRegion_gRectRunHeadPtr; } else { int32_t ySpanCount, intervalCount; - if (buffer.readS32(&ySpanCount) && buffer.readS32(&intervalCount)) { + if (buffer.readS32(&ySpanCount) && buffer.readS32(&intervalCount) && + intervalCount > 1) { tmp.allocateRuns(count, ySpanCount, intervalCount); buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType)); } |