From e490420efc931db8d2c8f397ddf704aab980295d Mon Sep 17 00:00:00 2001 From: "scroggo@google.com" Date: Wed, 9 Jan 2013 22:02:58 +0000 Subject: Ensure that SkMemoryStream does not crash dereferencing fData. SkMemoryStream attempts to dereference fData in multiple places. Instead of allowing it to be NULL, resulting in a crash, set it to SkData::NewEmpty(). Add a test for SkStream that will crash when its SkData is set to NULL. Review URL: https://codereview.appspot.com/7061059 git-svn-id: http://skia.googlecode.com/svn/trunk@7111 2bbb7eff-a529-9590-31e7-b0007b416f81 --- src/core/SkStream.cpp | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/core/SkStream.cpp b/src/core/SkStream.cpp index 2851e5fec3..f173b9e8c6 100644 --- a/src/core/SkStream.cpp +++ b/src/core/SkStream.cpp @@ -299,9 +299,13 @@ SkMemoryStream::SkMemoryStream(const void* src, size_t size, bool copyData) { fOffset = 0; } -SkMemoryStream::SkMemoryStream(SkData *data) { - fData = SkSafeRef(data); - fOffset = 0; +SkMemoryStream::SkMemoryStream(SkData* data) { + if (NULL == data) { + fData = SkData::NewEmpty(); + } else { + fData = data; + fData->ref(); + } } SkMemoryStream::~SkMemoryStream() { @@ -326,7 +330,13 @@ SkData* SkMemoryStream::copyToData() const { } SkData* SkMemoryStream::setData(SkData* data) { - SkRefCnt_SafeAssign(fData, data); + fData->unref(); + if (NULL == data) { + fData = SkData::NewEmpty(); + } else { + fData = data; + fData->ref(); + } return data; } -- cgit v1.2.3