Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(329)

Side by Side Diff: src/core/SkMallocPixelRef.cpp

Issue 116773002: Fixed more fuzzer issues (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Changed isAvailable for validateAvailable Created 7 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright 2011 Google Inc. 2 * Copyright 2011 Google Inc.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license that can be 4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file. 5 * found in the LICENSE file.
6 */ 6 */
7 7
8 #include "SkMallocPixelRef.h" 8 #include "SkMallocPixelRef.h"
9 #include "SkBitmap.h" 9 #include "SkBitmap.h"
10 #include "SkFlattenableBuffers.h" 10 #include "SkFlattenableBuffers.h"
(...skipping 125 matching lines...) Expand 10 before | Expand all | Expand 10 after
136 fCTable->writeToBuffer(buffer); 136 fCTable->writeToBuffer(buffer);
137 } 137 }
138 } 138 }
139 139
140 SkMallocPixelRef::SkMallocPixelRef(SkFlattenableReadBuffer& buffer) 140 SkMallocPixelRef::SkMallocPixelRef(SkFlattenableReadBuffer& buffer)
141 : INHERITED(buffer, NULL) 141 : INHERITED(buffer, NULL)
142 , fOwnPixels(true) 142 , fOwnPixels(true)
143 { 143 {
144 fRB = buffer.read32(); 144 fRB = buffer.read32();
145 size_t size = this->info().getSafeSize(fRB); 145 size_t size = this->info().getSafeSize(fRB);
146 fStorage = sk_malloc_throw(size); 146 if (buffer.validateAvailable(size)) {
147 buffer.readByteArray(fStorage, size); 147 fStorage = sk_malloc_throw(size);
148 buffer.readByteArray(fStorage, size);
149 } else {
150 fStorage = NULL;
151 }
152
148 if (buffer.readBool()) { 153 if (buffer.readBool()) {
149 fCTable = SkNEW_ARGS(SkColorTable, (buffer)); 154 fCTable = SkNEW_ARGS(SkColorTable, (buffer));
150 } else { 155 } else {
151 fCTable = NULL; 156 fCTable = NULL;
152 } 157 }
153 158
154 this->setPreLocked(fStorage, fCTable); 159 this->setPreLocked(fStorage, fCTable);
155 } 160 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698