Index: src/core/SkBitmap.cpp |
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp |
index d2a308b03ab950fe536980ea0a84a8d6122f62f9..7e204f22d33811fd729815881bbf88352492a638 100644 |
--- a/src/core/SkBitmap.cpp |
+++ b/src/core/SkBitmap.cpp |
@@ -1557,8 +1557,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) && |
SkIsValidConfig(config) && validate_alphaType(config, alphaType)); |
- this->setConfig(config, width, height, rowBytes, alphaType); |
- buffer.validate(fRowBytes >= (fWidth * fBytesPerPixel)); |
+ bool configIsValid = this->setConfig(config, width, height, rowBytes, alphaType); |
+ // Note : Using (fRowBytes >= (fWidth * fBytesPerPixel)) in the following test can create false |
+ // positives if the multiplication causes an integer overflow. Use the division instead. |
+ buffer.validate(configIsValid && (fBytesPerPixel > 0) && |
+ ((fRowBytes / fBytesPerPixel) >= fWidth)); |
int reftype = buffer.readInt(); |
if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) || |