Index: src/effects/gradients/SkGradientShader.cpp |
diff --git a/src/effects/gradients/SkGradientShader.cpp b/src/effects/gradients/SkGradientShader.cpp |
index 5d200d18d354135f7f11e4807964631edc32409e..6925ad2e4b71bf94d4b0307812ef4778e833a49b 100644 |
--- a/src/effects/gradients/SkGradientShader.cpp |
+++ b/src/effects/gradients/SkGradientShader.cpp |
@@ -154,8 +154,13 @@ SkGradientShaderBase::SkGradientShaderBase(SkFlattenableReadBuffer& buffer) : IN |
int colorCount = fColorCount = buffer.getArrayCount(); |
if (colorCount > kColorStorageCount) { |
- size_t size = sizeof(SkColor) + sizeof(SkPMColor) + sizeof(Rec); |
- fOrigColors = (SkColor*)sk_malloc_throw(size * colorCount); |
+ size_t allocSize = (sizeof(SkColor) + sizeof(SkPMColor) + sizeof(Rec)) * colorCount; |
+ if (buffer.validateAvailable(allocSize)) { |
+ fOrigColors = reinterpret_cast<SkColor*>(sk_malloc_throw(allocSize)); |
+ } else { |
+ fOrigColors = NULL; |
+ colorCount = fColorCount = 0; |
+ } |
} else { |
fOrigColors = fStorage; |
} |