Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(248)

Side by Side Diff: src/core/SkBitmap.cpp

Issue 2104973003: Address two fuzzer bugs (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | src/core/SkPicturePlayback.cpp » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright 2008 The Android Open Source Project 2 * Copyright 2008 The Android Open Source Project
3 * 3 *
4 * Use of this source code is governed by a BSD-style license that can be 4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file. 5 * found in the LICENSE file.
6 */ 6 */
7 7
8 #include "SkAtomics.h" 8 #include "SkAtomics.h"
9 #include "SkBitmap.h" 9 #include "SkBitmap.h"
10 #include "SkColorPriv.h" 10 #include "SkColorPriv.h"
(...skipping 1127 matching lines...) Expand 10 before | Expand all | Expand 10 after
1138 1138
1139 bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) { 1139 bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) {
1140 const size_t snugRB = buffer->readUInt(); 1140 const size_t snugRB = buffer->readUInt();
1141 if (0 == snugRB) { // no pixels 1141 if (0 == snugRB) { // no pixels
1142 return false; 1142 return false;
1143 } 1143 }
1144 1144
1145 SkImageInfo info; 1145 SkImageInfo info;
1146 info.unflatten(*buffer); 1146 info.unflatten(*buffer);
1147 1147
1148 // If there was an error reading "info", don't use it to compute minRowBytes () 1148 // If there was an error reading "info" or if it is bogus,
1149 if (!buffer->validate(true)) { 1149 // don't use it to compute minRowBytes()
1150 if (!buffer->validate(SkColorTypeValidateAlphaType(info.colorType(),
1151 info.alphaType()))) {
1150 return false; 1152 return false;
1151 } 1153 }
1152 1154
1153 const size_t ramRB = info.minRowBytes(); 1155 const size_t ramRB = info.minRowBytes();
1154 const int height = SkMax32(info.height(), 0); 1156 const int height = SkMax32(info.height(), 0);
1155 const uint64_t snugSize = sk_64_mul(snugRB, height); 1157 const uint64_t snugSize = sk_64_mul(snugRB, height);
1156 const uint64_t ramSize = sk_64_mul(ramRB, height); 1158 const uint64_t ramSize = sk_64_mul(ramRB, height);
1157 static const uint64_t max_size_t = (size_t)(-1); 1159 static const uint64_t max_size_t = (size_t)(-1);
1158 if (!buffer->validate((snugSize <= ramSize) && (ramSize <= max_size_t))) { 1160 if (!buffer->validate((snugSize <= ramSize) && (ramSize <= max_size_t))) {
1159 return false; 1161 return false;
(...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after
1347 /////////////////////////////////////////////////////////////////////////////// 1349 ///////////////////////////////////////////////////////////////////////////////
1348 1350
1349 #ifdef SK_DEBUG 1351 #ifdef SK_DEBUG
1350 void SkImageInfo::validate() const { 1352 void SkImageInfo::validate() const {
1351 SkASSERT(fWidth >= 0); 1353 SkASSERT(fWidth >= 0);
1352 SkASSERT(fHeight >= 0); 1354 SkASSERT(fHeight >= 0);
1353 SkASSERT(SkColorTypeIsValid(fColorType)); 1355 SkASSERT(SkColorTypeIsValid(fColorType));
1354 SkASSERT(SkAlphaTypeIsValid(fAlphaType)); 1356 SkASSERT(SkAlphaTypeIsValid(fAlphaType));
1355 } 1357 }
1356 #endif 1358 #endif
OLDNEW
« no previous file with comments | « no previous file | src/core/SkPicturePlayback.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698