OLD | NEW |
---|---|
1 /* | 1 /* |
2 * Copyright 2013 Google Inc. | 2 * Copyright 2013 Google Inc. |
3 * | 3 * |
4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
6 */ | 6 */ |
7 | 7 |
8 #include "SkBitmap.h" | 8 #include "SkBitmap.h" |
9 #include "SkErrorInternals.h" | 9 #include "SkErrorInternals.h" |
10 #include "SkValidatingReadBuffer.h" | 10 #include "SkValidatingReadBuffer.h" |
(...skipping 204 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
215 SkTypeface* SkValidatingReadBuffer::readTypeface() { | 215 SkTypeface* SkValidatingReadBuffer::readTypeface() { |
216 SkASSERT(false); | 216 SkASSERT(false); |
217 // TODO: Implement this (securely) when needed | 217 // TODO: Implement this (securely) when needed |
218 return nullptr; | 218 return nullptr; |
219 } | 219 } |
220 | 220 |
221 bool SkValidatingReadBuffer::validateAvailable(size_t size) { | 221 bool SkValidatingReadBuffer::validateAvailable(size_t size) { |
222 return this->validate((size <= SK_MaxU32) && fReader.isAvailable(static_cast <uint32_t>(size))); | 222 return this->validate((size <= SK_MaxU32) && fReader.isAvailable(static_cast <uint32_t>(size))); |
223 } | 223 } |
224 | 224 |
225 SkFlattenable* SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type type) { | 225 SkFlattenable* SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) { |
226 SkString name; | 226 SkString name; |
227 this->readString(&name); | 227 this->readString(&name); |
228 if (fError) { | 228 if (fError) { |
229 return nullptr; | 229 return nullptr; |
230 } | 230 } |
231 | 231 |
232 // Is this the type we wanted ? | |
233 const char* cname = name.c_str(); | 232 const char* cname = name.c_str(); |
234 SkFlattenable::Type baseType; | |
235 if (!SkFlattenable::NameToType(cname, &baseType) || (baseType != type)) { | |
Stephen White
2016/04/05 18:10:51
I believe this code is necessary for security. sug
| |
236 return nullptr; | |
237 } | |
238 | |
239 SkFlattenable::Factory factory = SkFlattenable::NameToFactory(cname); | 233 SkFlattenable::Factory factory = SkFlattenable::NameToFactory(cname); |
240 if (nullptr == factory) { | 234 if (nullptr == factory) { |
241 return nullptr; // writer failed to give us the flattenable | 235 return nullptr; // writer failed to give us the flattenable |
242 } | 236 } |
243 | 237 |
244 // if we get here, factory may still be null, but if that is the case, the | 238 // if we get here, factory may still be null, but if that is the case, the |
245 // failure was ours, not the writer. | 239 // failure was ours, not the writer. |
246 sk_sp<SkFlattenable> obj; | 240 sk_sp<SkFlattenable> obj; |
247 uint32_t sizeRecorded = this->readUInt(); | 241 uint32_t sizeRecorded = this->readUInt(); |
248 if (factory) { | 242 if (factory) { |
(...skipping 15 matching lines...) Expand all Loading... | |
264 | 258 |
265 void SkValidatingReadBuffer::skipFlattenable() { | 259 void SkValidatingReadBuffer::skipFlattenable() { |
266 SkString name; | 260 SkString name; |
267 this->readString(&name); | 261 this->readString(&name); |
268 if (fError) { | 262 if (fError) { |
269 return; | 263 return; |
270 } | 264 } |
271 uint32_t sizeRecorded = this->readUInt(); | 265 uint32_t sizeRecorded = this->readUInt(); |
272 this->skip(sizeRecorded); | 266 this->skip(sizeRecorded); |
273 } | 267 } |
OLD | NEW |