Changed maxInputCount for exact inputCount

src/core/SkImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkImageFilter.h"
 
 #include "SkBitmap.h"
@@ skipping 35 matching lines @@
     SkSafeRef(fInputs[1]);
 }
 
 SkImageFilter::~SkImageFilter() {
     for (int i = 0; i < fInputCount; i++) {
         SkSafeUnref(fInputs[i]);
     }
     delete[] fInputs;
 }
 
-SkImageFilter::SkImageFilter(int maxInputCount, SkFlattenableReadBuffer& buffer) {
+SkImageFilter::SkImageFilter(int inputCount, SkFlattenableReadBuffer& buffer) {
     fInputCount = buffer.readInt();
-    if (buffer.validate((fInputCount >= 0) && (fInputCount <= maxInputCount))) {
+    if (buffer.validate(((inputCount < 0) && (fInputCount >= 0)) || (fInputCount == inputCount))) {

[Stephen White, 2013/12/03 19:10:23]

I think this will pass validation if a deserialized stream contains -1 as an
input count, and inputCount is also -1. I don't think it should.

[sugoi, 2013/12/03 19:21:49]

Done.

         fInputs = new SkImageFilter*[fInputCount];
         for (int i = 0; i < fInputCount; i++) {
             if (buffer.readBool()) {
                 fInputs[i] = buffer.readImageFilter();
             } else {
                 fInputs[i] = NULL;
             }
         }
         SkRect rect;
         buffer.readRect(&rect);
@@ skipping 118 matching lines @@
     return true;
 }
 
 bool SkImageFilter::asNewEffect(GrEffectRef**, GrTexture*, const SkMatrix&, const SkIRect&) const {
     return false;
 }
 
 bool SkImageFilter::asColorFilter(SkColorFilter**) const {
     return false;
 }