Chromium Code Reviews| Index: src/codec/SkSwizzler.cpp |
| diff --git a/src/codec/SkSwizzler.cpp b/src/codec/SkSwizzler.cpp |
| index f8e89c7acbc638006ca365e4bf85b67d1c109af6..4da862fe9a89844ffee7104bc2a8817c10f9b6f1 100644 |
| --- a/src/codec/SkSwizzler.cpp |
| +++ b/src/codec/SkSwizzler.cpp |
| @@ -43,10 +43,12 @@ static SkSwizzler::ResultAlpha swizzle_bit_to_grayscale( |
| // Finish the remaining bits |
| width &= 7; |
| - U8CPU currByte = src[i]; |
|
msarett
2015/08/05 20:39:08
This reads out of bounds memory when width is a mu
|
| - for (int j = 0; j < width; j++) { |
| - dst[j] = ((currByte >> 7) & 1) ? GRAYSCALE_WHITE : GRAYSCALE_BLACK; |
| - currByte <<= 1; |
| + if (width > 0) { |
| + U8CPU currByte = src[i]; |
| + for (int j = 0; j < width; j++) { |
| + dst[j] = ((currByte >> 7) & 1) ? GRAYSCALE_WHITE : GRAYSCALE_BLACK; |
| + currByte <<= 1; |
| + } |
| } |
| return SkSwizzler::kOpaque_ResultAlpha; |
| } |
| @@ -72,10 +74,12 @@ static SkSwizzler::ResultAlpha swizzle_bit_to_index( |
| // Finish the remaining bits |
| width &= 7; |
| - U8CPU currByte = src[i]; |
| - for (int j = 0; j < width; j++) { |
| - dst[j] = ((currByte >> 7) & 1); |
| - currByte <<= 1; |
| + if (width > 0) { |
| + U8CPU currByte = src[i]; |
| + for (int j = 0; j < width; j++) { |
| + dst[j] = ((currByte >> 7) & 1); |
| + currByte <<= 1; |
| + } |
| } |
| return SkSwizzler::kOpaque_ResultAlpha; |
| } |
| @@ -98,10 +102,12 @@ static SkSwizzler::ResultAlpha swizzle_bit_to_n32( |
| // Finish the remaining bits |
| width &= 7; |
| - U8CPU currByte = src[i]; |
| - for (int j = 0; j < width; j++) { |
| - dst[j] = ((currByte >> 7) & 1) ? SK_ColorWHITE : SK_ColorBLACK; |
| - currByte <<= 1; |
| + if (width > 0) { |
| + U8CPU currByte = src[i]; |
| + for (int j = 0; j < width; j++) { |
| + dst[j] = ((currByte >> 7) & 1) ? SK_ColorWHITE : SK_ColorBLACK; |
| + currByte <<= 1; |
| + } |
| } |
| return SkSwizzler::kOpaque_ResultAlpha; |
| } |