Add preflight checks for SkImage deserialization

Bug: skia:7937
Change-Id: Ia6d8eeeeaf9ea38df7e4f78b23598a66142bf8de
Reviewed-on: https://skia-review.googlesource.com/128301
Reviewed-by: Florin Malita <fmalita@chromium.org>
Commit-Queue: Kevin Lubick <kjlubick@google.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/core/SkReadBuffer.cpp b/src/core/SkReadBuffer.cpp
index adf9e64403..d41f2902f2 100644
--- a/src/core/SkReadBuffer.cpp
+++ b/src/core/SkReadBuffer.cpp
@@ -314,6 +314,13 @@ sk_sp<SkImage> SkReadBuffer::readImage() {
         return nullptr;
     }
 
+    // Preflight check to make sure there's enough stuff in the buffer before
+    // we allocate the memory. This helps the fuzzer avoid OOM when it creates
+    // bad/corrupt input.
+    if (!this->validate(((size_t)size) <= this->available())) {
+        return nullptr;
+    }
+
     sk_sp<SkData> data = SkData::MakeUninitialized(size);
     if (!this->readPad32(data->writable_data(), size)) {
         this->validate(false);