Fixed clusterfuzz found crash

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1548 matching lines @@
         buffer.writeInt(SERIALIZE_PIXELTYPE_NONE);
     }
 }
 
 void SkBitmap::unflatten(SkReadBuffer& buffer) {
     this->reset();
 
     SkImageInfo info;
     info.unflatten(buffer);
     size_t rowBytes = buffer.readInt();
-    buffer.validate((info.width() >= 0) && (info.height() >= 0) &&
-                    SkColorTypeIsValid(info.fColorType) &&
-                    SkAlphaTypeIsValid(info.fAlphaType) &&
-                    validate_alphaType(info.fColorType, info.fAlphaType) &&
-                    info.validRowBytes(rowBytes));
+    if (!buffer.validate((info.width() >= 0) && (info.height() >= 0) &&
+                         SkColorTypeIsValid(info.fColorType) &&
+                         SkAlphaTypeIsValid(info.fAlphaType) &&
+                         validate_alphaType(info.fColorType, info.fAlphaType) &&
+                         info.validRowBytes(rowBytes))) {
+        // Clear info if it's invalid
+        sk_bzero(&info, sizeof(SkImageInfo));

[reed2, 2014/02/13 16:55:48]

Why not just

if (invalid) {
   return;
}

We've already zero'd the bitmap itself on line 1564.

[sugoi1, 2014/02/13 18:05:53]

Done.

+    }
 
     bool configIsValid = this->setConfig(info, rowBytes);
     buffer.validate(configIsValid);
 
     int reftype = buffer.readInt();
     if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||
                         (SERIALIZE_PIXELTYPE_NONE == reftype))) {
         switch (reftype) {
             case SERIALIZE_PIXELTYPE_REF_DATA: {
                 SkIPoint origin;
@@ skipping 100 matching lines @@
 ///////////////////////////////////////////////////////////////////////////////
 
 #ifdef SK_DEBUG
 void SkImageInfo::validate() const {
     SkASSERT(fWidth >= 0);
     SkASSERT(fHeight >= 0);
     SkASSERT(SkColorTypeIsValid(fColorType));
     SkASSERT(SkAlphaTypeIsValid(fAlphaType));
 }
 #endif