Index: src/core/SkBitmap.cpp |
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp |
index ad840c4390e0d2b93d0325b39cc2802ebaca9113..3691f1e86036830295d1c657c2a9cd49831f2beb 100644 |
--- a/src/core/SkBitmap.cpp |
+++ b/src/core/SkBitmap.cpp |
@@ -1559,8 +1559,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) && |
SkIsValidConfig(config) && validate_alphaType(config, alphaType)); |
- this->setConfig(config, width, height, rowBytes, alphaType); |
- buffer.validate(fRowBytes >= (fWidth * fBytesPerPixel)); |
+ bool configIsValid = this->setConfig(config, width, height, rowBytes, alphaType); |
+ // Note : Using (fRowBytes >= (fWidth * fBytesPerPixel)) in the following test can create false |
+ // positives if the multiplication causes an integer overflow. Use the division instead. |
+ buffer.validate(configIsValid && (fBytesPerPixel > 0) && |
+ ((fRowBytes / fBytesPerPixel) >= fWidth)); |
int reftype = buffer.readInt(); |
if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) || |