Index: src/core/SkPaint.cpp |
diff --git a/src/core/SkPaint.cpp b/src/core/SkPaint.cpp |
index c0e552ae358611b17977f2095d8cc3311fe8c74d..e5fe975bcd7db719b5ef7e4018919e4bbc36f74e 100644 |
--- a/src/core/SkPaint.cpp |
+++ b/src/core/SkPaint.cpp |
@@ -1946,6 +1946,9 @@ void SkPaint::flatten(SkWriteBuffer& buffer) const { |
void SkPaint::unflatten(SkReadBuffer& buffer) { |
SkASSERT(SkAlign4(kPODPaintSize) == kPODPaintSize); |
+ if (!buffer.validateAvailable(kPODPaintSize)) { |
+ return; |
+ } |
const void* podData = buffer.skip(kPODPaintSize); |
const uint32_t* pod = reinterpret_cast<const uint32_t*>(podData); |