Fixed a few places where uninitialized memory could have been read

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1541 matching lines @@
     this->reset();
 
     int width = buffer.readInt();
     int height = buffer.readInt();
     int rowBytes = buffer.readInt();
     Config config = (Config)buffer.readInt();
     SkAlphaType alphaType = (SkAlphaType)buffer.readInt();
     buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) &&
                     SkIsValidConfig(config) && validate_alphaType(config, alphaType));
 
-    this->setConfig(config, width, height, rowBytes, alphaType);
-    buffer.validate(fRowBytes >= (fWidth * fBytesPerPixel));
+    buffer.validate(this->setConfig(config, width, height, rowBytes, alphaType));

[Stephen White, 2013/12/05 20:48:22]

Nit: this might be clearer if the result of setConfig() was stored in a
temporary, and we buffer.validate() that. Maybe someone else could chime in. My
thought was that the intent of the setConfig() was a little hidden.

+    // Note : Using (fRowBytes >= (fWidth * fBytesPerPixel)) in the following test can create false
+    //        positives if the multiplication causes an integer overflow. Use the division instead.
+    buffer.validate((fBytesPerPixel > 0) && ((fRowBytes / fBytesPerPixel) >= fWidth));
 
     int reftype = buffer.readInt();
     if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||
                         (SERIALIZE_PIXELTYPE_NONE == reftype))) {
         switch (reftype) {
             case SERIALIZE_PIXELTYPE_REF_DATA: {
                 size_t offset = buffer.readUInt();
                 SkPixelRef* pr = buffer.readPixelRef();
                 if (!buffer.validate((NULL == pr) ||
                        (pr->getAllocatedSizeInBytes() >= (offset + this->getSafeSize())))) {
@@ skipping 82 matching lines @@
         if (NULL != uri) {
             str->appendf(" uri:\"%s\"", uri);
         } else {
             str->appendf(" pixelref:%p", pr);
         }
     }
 
     str->append(")");
 }
 #endif