fix bounds check for ctables (thanks Hal)

src/core/SkColorTable.cpp

 
 /*
  * Copyright 2009 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkColorTable.h"
@@ skipping 18 matching lines @@
     } else if (count > 256) {
         count = 256;
     }
     this->init(colors, count);
 }
 
 SkColorTable::SkColorTable(SkPMColor* colors, int count, AllocatedWithMalloc)
     : fColors(colors)
     , fCount(count)
 {
-    SkASSERT(count > 0 && count <= 255);
+    SkASSERT(count > 0 && count <= 256);
     SkASSERT(colors);
 }
 
 SkColorTable::~SkColorTable() {
     sk_free(fColors);
     // f16BitCache frees itself
 }
 
 #include "SkColorPriv.h"
 
@@ skipping 51 matching lines @@
 SkColorTable* SkColorTable::Create(SkReadBuffer& buffer) {
     if (buffer.isVersionLT(SkReadBuffer::kRemoveColorTableAlpha_Version)) {
         /*fAlphaType = */buffer.readUInt();
     }
 
     const int count = buffer.getArrayCount();
     if (0 == count) {
         return new SkColorTable(nullptr, 0);
     }
 
-    if (count < 0 || count > 255) {
+    if (count < 0 || count > 256) {
         buffer.validate(false);
         return nullptr;
     }
 
     const size_t allocSize = count * sizeof(SkPMColor);
     SkAutoTDelete<SkPMColor> colors((SkPMColor*)sk_malloc_throw(allocSize));
     if (!buffer.readColorArray(colors, count)) {
         return nullptr;
     }
 
     return new SkColorTable(colors.detach(), count, kAllocatedWithMalloc);
 }