Changed maxInputCount for exact inputCount

src/core/SkImageFilter.cpp

Index: src/core/SkImageFilter.cpp
diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
index cca22bba5596eb7a99dc4762a3e63655f9d0a835..b2bd0eb10e0c2cfc5f4c4f08f335d2066cd5a728 100644
--- a/src/core/SkImageFilter.cpp
+++ b/src/core/SkImageFilter.cpp
@@ -53,9 +53,9 @@ SkImageFilter::~SkImageFilter() {
     delete[] fInputs;
 }
 
-SkImageFilter::SkImageFilter(int maxInputCount, SkFlattenableReadBuffer& buffer) {
+SkImageFilter::SkImageFilter(int inputCount, SkFlattenableReadBuffer& buffer) {
     fInputCount = buffer.readInt();
-    if (buffer.validate((fInputCount >= 0) && (fInputCount <= maxInputCount))) {
+    if (buffer.validate(((inputCount < 0) && (fInputCount >= 0)) || (fInputCount == inputCount))) {

[Stephen White, 2013/12/03 19:10:23]

I think this will pass validation if a deserialized stream contains -1 as an
input count, and inputCount is also -1. I don't think it should.

[sugoi, 2013/12/03 19:21:49]

Done.

         fInputs = new SkImageFilter*[fInputCount];
         for (int i = 0; i < fInputCount; i++) {
             if (buffer.readBool()) {