Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(54)

Unified Diff: src/codec/SkBmpRLECodec.cpp

Issue 1498923002: Fix overflow caught by ASAN. (Closed) Base URL: https://skia.googlesource.com/skia@master
Patch Set: Make variable const. Created 5 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/codec/SkBmpRLECodec.h ('k') | src/codec/SkBmpStandardCodec.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/codec/SkBmpRLECodec.cpp
diff --git a/src/codec/SkBmpRLECodec.cpp b/src/codec/SkBmpRLECodec.cpp
index 4cee274ffecc31534acb8d56380727ed3967463c..b01012644bfded083a27c95deb41bff5be0f96be 100644
--- a/src/codec/SkBmpRLECodec.cpp
+++ b/src/codec/SkBmpRLECodec.cpp
@@ -21,7 +21,7 @@ SkBmpRLECodec::SkBmpRLECodec(const SkImageInfo& info, SkStream* stream,
size_t RLEBytes)
: INHERITED(info, stream, bitsPerPixel, rowOrder)
, fColorTable(nullptr)
- , fNumColors(this->computeNumColors(numColors))
+ , fNumColors(numColors)
, fBytesPerColor(bytesPerColor)
, fOffset(offset)
, fStreamBuffer(new uint8_t[RLEBytes])
@@ -82,9 +82,12 @@ SkCodec::Result SkBmpRLECodec::onGetPixels(const SkImageInfo& dstInfo,
// access memory outside of our color table array.
*numColors = maxColors;
}
+ // Don't bother reading more than maxColors.
+ const uint32_t numColorsToRead =
+ fNumColors == 0 ? maxColors : SkTMin(fNumColors, maxColors);
// Read the color table from the stream
- colorBytes = fNumColors * fBytesPerColor;
+ colorBytes = numColorsToRead * fBytesPerColor;
SkAutoTDeleteArray<uint8_t> cBuffer(new uint8_t[colorBytes]);
if (stream()->read(cBuffer.get(), colorBytes) != colorBytes) {
SkCodecPrintf("Error: unable to read color table.\n");
@@ -93,7 +96,7 @@ SkCodec::Result SkBmpRLECodec::onGetPixels(const SkImageInfo& dstInfo,
// Fill in the color table
uint32_t i = 0;
- for (; i < fNumColors; i++) {
+ for (; i < numColorsToRead; i++) {
uint8_t blue = get_byte(cBuffer.get(), i*fBytesPerColor);
uint8_t green = get_byte(cBuffer.get(), i*fBytesPerColor + 1);
uint8_t red = get_byte(cBuffer.get(), i*fBytesPerColor + 2);
« no previous file with comments | « src/codec/SkBmpRLECodec.h ('k') | src/codec/SkBmpStandardCodec.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698