Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(14)

Side by Side Diff: src/core/SkMallocPixelRef.cpp

Issue 107003006: Fixing crash found by fuzzer (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Created 7 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright 2011 Google Inc. 2 * Copyright 2011 Google Inc.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license that can be 4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file. 5 * found in the LICENSE file.
6 */ 6 */
7 7
8 #include "SkMallocPixelRef.h" 8 #include "SkMallocPixelRef.h"
9 #include "SkBitmap.h" 9 #include "SkBitmap.h"
10 #include "SkFlattenableBuffers.h" 10 #include "SkFlattenableBuffers.h"
(...skipping 124 matching lines...) Expand 10 before | Expand all | Expand 10 after
135 if (fCTable) { 135 if (fCTable) {
136 fCTable->writeToBuffer(buffer); 136 fCTable->writeToBuffer(buffer);
137 } 137 }
138 } 138 }
139 139
140 SkMallocPixelRef::SkMallocPixelRef(SkFlattenableReadBuffer& buffer) 140 SkMallocPixelRef::SkMallocPixelRef(SkFlattenableReadBuffer& buffer)
141 : INHERITED(buffer, NULL) 141 : INHERITED(buffer, NULL)
142 , fOwnPixels(true) 142 , fOwnPixels(true)
143 { 143 {
144 fRB = buffer.read32(); 144 fRB = buffer.read32();
145 size_t size = this->info().getSafeSize(fRB); 145 size_t size = buffer.isValid() ? this->info().getSafeSize(fRB) : 0;
146 if (buffer.validateAvailable(size)) { 146 if (buffer.validateAvailable(size)) {
147 fStorage = sk_malloc_throw(size); 147 fStorage = sk_malloc_throw(size);
148 buffer.readByteArray(fStorage, size); 148 buffer.readByteArray(fStorage, size);
149 } else { 149 } else {
150 fStorage = NULL; 150 fStorage = NULL;
151 } 151 }
152 152
153 if (buffer.readBool()) { 153 if (buffer.readBool()) {
154 fCTable = SkNEW_ARGS(SkColorTable, (buffer)); 154 fCTable = SkNEW_ARGS(SkColorTable, (buffer));
155 } else { 155 } else {
156 fCTable = NULL; 156 fCTable = NULL;
157 } 157 }
158 158
159 this->setPreLocked(fStorage, fCTable); 159 this->setPreLocked(fStorage, fCTable);
160 } 160 }
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698