diff options
| author |  commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-10-31 18:37:50 +0000 |
|---|---|---|
| committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-10-31 18:37:50 +0000 |
| commit | 025128811219dc45fd99b6c4d1d14f833cf7a26e (patch) | |
| tree | 13a1ed285bb5a34fae47212c02e0aec4c979fe46 /src/effects/SkEmbossMaskFilter.cpp | |
| parent | 4469938e92d779dff05e745559e67907bbf21e78 (diff) | |
Adding size parameter to read array functions
In some cases, the allocated array into which the data will be read is using getArrayCount() to allocate itself, which should be safe, but some cases use fixed length arrays or compute the array size before reading, which could overflow if the stream is compromised.
To prevent that from happening, I added a check that will verify that the number of bytes to read will not exceed the capacity of the input buffer argument passed to all the read...Array() functions.
I chose to use the byte array for this initial version, so that "size" represents the same value across all read...Array() functions, but I could also use the element count, if it is preferred.
Note : readPointArray and writePointArray are unused, so I could also remove them
BUG=
R=reed@google.com, mtklein@google.com, senorblanco@chromium.org
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/37803002
git-svn-id: http://skia.googlecode.com/svn/trunk@12058 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'src/effects/SkEmbossMaskFilter.cpp')
| -rw-r--r-- | src/effects/SkEmbossMaskFilter.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/effects/SkEmbossMaskFilter.cpp b/src/effects/SkEmbossMaskFilter.cpp index 31beb511d5..2d3125000c 100644 --- a/src/effects/SkEmbossMaskFilter.cpp +++ b/src/effects/SkEmbossMaskFilter.cpp @@ -132,7 +132,7 @@ bool SkEmbossMaskFilter::filterMask(SkMask* dst, const SkMask& src, SkEmbossMaskFilter::SkEmbossMaskFilter(SkFlattenableReadBuffer& buffer) : SkMaskFilter(buffer) { SkASSERT(buffer.getArrayCount() == sizeof(Light)); - buffer.readByteArray(&fLight); + buffer.readByteArray(&fLight, sizeof(Light)); SkASSERT(fLight.fPad == 0); // for the font-cache lookup to be clean fBlurSigma = buffer.readScalar(); #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V13_AND_ALL_OTHER_INSTANCES_TOO |