Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(154)

Unified Diff: src/effects/gradients/SkGradientShader.cpp

Issue 116773002: Fixed more fuzzer issues (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Changed isAvailable for validateAvailable Created 7 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: src/effects/gradients/SkGradientShader.cpp
diff --git a/src/effects/gradients/SkGradientShader.cpp b/src/effects/gradients/SkGradientShader.cpp
index 5d200d18d354135f7f11e4807964631edc32409e..6925ad2e4b71bf94d4b0307812ef4778e833a49b 100644
--- a/src/effects/gradients/SkGradientShader.cpp
+++ b/src/effects/gradients/SkGradientShader.cpp
@@ -154,8 +154,13 @@ SkGradientShaderBase::SkGradientShaderBase(SkFlattenableReadBuffer& buffer) : IN
int colorCount = fColorCount = buffer.getArrayCount();
if (colorCount > kColorStorageCount) {
- size_t size = sizeof(SkColor) + sizeof(SkPMColor) + sizeof(Rec);
- fOrigColors = (SkColor*)sk_malloc_throw(size * colorCount);
+ size_t allocSize = (sizeof(SkColor) + sizeof(SkPMColor) + sizeof(Rec)) * colorCount;
+ if (buffer.validateAvailable(allocSize)) {
+ fOrigColors = reinterpret_cast<SkColor*>(sk_malloc_throw(allocSize));
+ } else {
+ fOrigColors = NULL;
+ colorCount = fColorCount = 0;
+ }
} else {
fOrigColors = fStorage;
}

Powered by Google App Engine
This is Rietveld 408576698