Index: src/image/SkSurface_Raster.cpp |
diff --git a/src/image/SkSurface_Raster.cpp b/src/image/SkSurface_Raster.cpp |
index 61ade6f46c8ec6584c3a5a18995dff3a766cca2c..27db504df6f056e8d35d1ca68adc608bfa4164d7 100644 |
--- a/src/image/SkSurface_Raster.cpp |
+++ b/src/image/SkSurface_Raster.cpp |
@@ -155,9 +155,19 @@ |
return NULL; |
} |
- SkAutoTUnref<SkPixelRef> pr(SkMallocPixelRef::NewAllocate(info, 0, NULL)); |
- if (NULL == pr.get()) { |
+ static const size_t kMaxTotalSize = SK_MaxS32; |
+ size_t rowBytes = SkImageMinRowBytes(info); |
+ uint64_t size64 = (uint64_t)info.fHeight * rowBytes; |
+ if (size64 > kMaxTotalSize) { |
return NULL; |
} |
- return SkNEW_ARGS(SkSurface_Raster, (info, pr, info.minRowBytes())); |
+ |
+ size_t size = (size_t)size64; |
+ void* pixels = sk_malloc_throw(size); |
+ if (NULL == pixels) { |
+ return NULL; |
+ } |
+ |
+ SkAutoTUnref<SkPixelRef> pr(SkNEW_ARGS(SkMallocPixelRef, (pixels, size, NULL, true))); |
+ return SkNEW_ARGS(SkSurface_Raster, (info, pr, rowBytes)); |
} |