detect bad/corrupt flattenable factory indices

src/core/SkReadBuffer.cpp

 
 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
@@ skipping 322 matching lines @@
     //
 
     SkFlattenable::Factory factory = nullptr;
 
     if (fFactoryCount > 0) {
         int32_t index = fReader.readU32();
         if (0 == index) {
             return nullptr; // writer failed to give us the flattenable
         }
         index -= 1;     // we stored the index-base-1
-        SkASSERT(index < fFactoryCount);
+        if ((unsigned)index >= (unsigned)fFactoryCount) {
+            this->validate(false);
+            return nullptr;
+        }
         factory = fFactoryArray[index];
     } else if (fFactoryTDArray) {
         int32_t index = fReader.readU32();
         if (0 == index) {
             return nullptr; // writer failed to give us the flattenable
         }
         index -= 1;     // we stored the index-base-1
+        if ((unsigned)index >= (unsigned)fFactoryCount) {
+            this->validate(false);
+            return nullptr;
+        }
         factory = (*fFactoryTDArray)[index];
     } else {
         factory = (SkFlattenable::Factory)readFunctionPtr();
         if (nullptr == factory) {
             return nullptr; // writer failed to give us the flattenable
         }
     }
 
     // if we get here, factory may still be null, but if that is the case, the
     // failure was ours, not the writer.
     SkFlattenable* obj = nullptr;
     uint32_t sizeRecorded = fReader.readU32();
     if (factory) {
         size_t offset = fReader.offset();
         obj = (*factory)(*this);
         // check that we read the amount we expected
         size_t sizeRead = fReader.offset() - offset;
         if (sizeRecorded != sizeRead) {
-            // we could try to fix up the offset...
-            sk_throw();
+            this->validate(false);
+            return nullptr;
         }
     } else {
         // we must skip the remaining data
         fReader.skip(sizeRecorded);
     }
     return obj;
 }
 
 /**
  *  Needs to follow the same pattern as readFlattenable(), but explicitly skip whatever data
  *  has been written.
  */
 void SkReadBuffer::skipFlattenable() {
     if (fFactoryCount > 0) {
         if (0 == fReader.readU32()) {
             return;
         }
     } else if (fFactoryTDArray) {
         if (0 == fReader.readU32()) {
             return;
         }
     } else {
         if (nullptr == this->readFunctionPtr()) {
             return;
         }
     }
     uint32_t sizeRecorded = fReader.readU32();
     fReader.skip(sizeRecorded);
 }