| Index: src/core/SkData.cpp
|
| diff --git a/src/core/SkData.cpp b/src/core/SkData.cpp
|
| index dfbd00384975d93a622c7eabeccfaf5d8b091bd0..ad79ce05350064b128a4e210f7b4ef135ee896af 100644
|
| --- a/src/core/SkData.cpp
|
| +++ b/src/core/SkData.cpp
|
| @@ -63,7 +63,14 @@ SkData* SkData::PrivateNewWithCopy(const void* srcOrNull, size_t length) {
|
| if (0 == length) {
|
| return SkData::NewEmpty();
|
| }
|
| - char* storage = (char*)sk_malloc_throw(sizeof(SkData) + length);
|
| +
|
| + const size_t actualLength = length + sizeof(SkData);
|
| + if (actualLength < length) {
|
| + // we overflowed
|
| + sk_throw();
|
| + }
|
| +
|
| + char* storage = (char*)sk_malloc_throw(actualLength);
|
| SkData* data = new (storage) SkData(length);
|
| if (srcOrNull) {
|
| memcpy(data->writable_data(), srcOrNull, length);
|
|
|