1 files changed, 20 insertions, 4 deletions
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index 7d08184ed8..6fd97dc241 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1145,11 +1145,27 @@ bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) {
 
     SkAutoTUnref<SkColorTable> ctable;
     if (buffer->readBool()) {
-        ctable.reset(new SkColorTable(*buffer));
+        ctable.reset(SkColorTable::Create(*buffer));
+        if (!ctable) {
+            return false;
+        }
 
-        unsigned char maxIndex = ctable->count() ? ctable->count()-1 : 0;
-        for (uint64_t i = 0; i < ramSize; ++i) {
-            dst[i] = SkTMin(dst[i], maxIndex);
+        if (info.isEmpty()) {
+            // require an empty ctable
+            if (ctable->count() != 0) {
+                buffer->validate(false);
+                return false;
+            }
+        } else {
+            // require a non-empty ctable
+            if (ctable->count() == 0) {
+                buffer->validate(false);
+                return false;
+            }
+            unsigned char maxIndex = ctable->count() - 1;
+            for (uint64_t i = 0; i < ramSize; ++i) {
+                dst[i] = SkTMin(dst[i], maxIndex);
+            }
         }
     }