Prevent overflows when using gamma_alloc_size

src/core/SkColorSpace_ICC.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorSpace.h"
 #include "SkColorSpace_Base.h"
 #include "SkColorSpacePriv.h"
@@ skipping 769 matching lines @@
         handle_invalid_gamma(&rType, &rData);
         size_t alignedTagBytes = SkAlign4(tagBytes);
 
         if ((3 * alignedTagBytes <= tagLen) &&
             !memcmp(rTagPtr, rTagPtr + 1 * alignedTagBytes, tagBytes) &&
             !memcmp(rTagPtr, rTagPtr + 2 * alignedTagBytes, tagBytes))
         {
             if (SkGammas::Type::kNamed_Type == rType) {
                 *gammaNamed = rData.fNamed;
             } else {
-                size_t allocSize = sizeof(SkGammas) + gamma_alloc_size(rType, rData);
+                size_t allocSize = sizeof(SkGammas);
+                return_if_false(safe_add(allocSize, gamma_alloc_size(rType, rData), &allocSize), "bad size");

[msarett, 2016/08/10 17:24:51]

nit: Lines should be less than 100 chars.

nit: Change error message to "SkGammas struct is too large to allocate".

                 void* memory = sk_malloc_throw(allocSize);
                 *gammas = sk_sp<SkGammas>(new (memory) SkGammas());
                 load_gammas(memory, 0, rType, &rData, rParams, rTagPtr);
 
                 (*gammas)->fRedType = rType;
                 (*gammas)->fGreenType = rType;
                 (*gammas)->fBlueType = rType;
 
                 (*gammas)->fRedData = rData;
                 (*gammas)->fGreenData = rData;
@@ skipping 11 matching lines @@
 
             alignedTagBytes = SkAlign4(tagBytes);
             const uint8_t* bTagPtr = gTagPtr + alignedTagBytes;
             tagLen = tagLen > alignedTagBytes ? tagLen - alignedTagBytes : 0;
             SkGammas::Data bData;
             SkGammas::Params bParams;
             SkGammas::Type bType = parse_gamma(&bData, &bParams, &tagBytes, bTagPtr,
                                                        tagLen);
             handle_invalid_gamma(&bType, &bData);
 
-            size_t allocSize = sizeof(SkGammas) + gamma_alloc_size(rType, rData)
-                                                + gamma_alloc_size(gType, gData)
-                                                + gamma_alloc_size(bType, bData);
+            size_t allocSize = sizeof(SkGammas);
+            return_if_false(safe_add(allocSize, gamma_alloc_size(rType, rData), &allocSize), "bad size");

[msarett, 2016/08/10 17:24:51]

Same nits on these three lines as well.

+            return_if_false(safe_add(allocSize, gamma_alloc_size(gType, gData), &allocSize), "bad size");
+            return_if_false(safe_add(allocSize, gamma_alloc_size(bType, bData), &allocSize), "bad size");
             void* memory = sk_malloc_throw(allocSize);
             *gammas = sk_sp<SkGammas>(new (memory) SkGammas());
 
             uint32_t offset = 0;
             (*gammas)->fRedType = rType;
             offset += load_gammas(memory, offset, rType, &rData, rParams, rTagPtr);
 
             (*gammas)->fGreenType = gType;
             offset += load_gammas(memory, offset, gType, &gData, gParams, gTagPtr);
 
@@ skipping 128 matching lines @@
                     if (tag_equals(r, g, base) && tag_equals(g, b, base)) {
                         SkGammas::Data data;
                         SkGammas::Params params;
                         SkGammas::Type type =
                                 parse_gamma(&data, &params, &tagBytes, r->addr(base), r->fLength);
                         handle_invalid_gamma(&type, &data);
 
                         if (SkGammas::Type::kNamed_Type == type) {
                             gammaNamed = data.fNamed;
                         } else {
-                            size_t allocSize = sizeof(SkGammas) + gamma_alloc_size(type, data);
+                            size_t allocSize = sizeof(SkGammas);
+                            if (!safe_add(allocSize, gamma_alloc_size(type, data), &allocSize)) {
+                                return_null("bad size");

[msarett, 2016/08/10 17:24:51]

"SkGammas struct is too large to allocate"

+                            }
                             void* memory = sk_malloc_throw(allocSize);
                             gammas = sk_sp<SkGammas>(new (memory) SkGammas());
                             load_gammas(memory, 0, type, &data, params, r->addr(base));
 
                             gammas->fRedType = type;
                             gammas->fGreenType = type;
                             gammas->fBlueType = type;
 
                             gammas->fRedData = data;
                             gammas->fGreenData = data;
@@ skipping 11 matching lines @@
                         SkGammas::Type gType =
                                 parse_gamma(&gData, &gParams, &tagBytes, g->addr(base), g->fLength);
                         handle_invalid_gamma(&gType, &gData);
 
                         SkGammas::Data bData;
                         SkGammas::Params bParams;
                         SkGammas::Type bType =
                                 parse_gamma(&bData, &bParams, &tagBytes, b->addr(base), b->fLength);
                         handle_invalid_gamma(&bType, &bData);
 
-                        size_t allocSize = sizeof(SkGammas) + gamma_alloc_size(rType, rData)
-                                                            + gamma_alloc_size(gType, gData)
-                                                            + gamma_alloc_size(bType, bData);
+                        size_t allocSize = sizeof(SkGammas);
+                        if (!safe_add(allocSize, gamma_alloc_size(rType, rData), &allocSize) ||
+                            !safe_add(allocSize, gamma_alloc_size(gType, gData), &allocSize) ||
+                            !safe_add(allocSize, gamma_alloc_size(bType, bData), &allocSize)) {

[msarett, 2016/08/10 17:24:51]

nit: Move brace to it's own line

+                            return_null("bad size");

[msarett, 2016/08/10 17:24:51]

"SkGammas struct is too large to allocate"

+                        }
                         void* memory = sk_malloc_throw(allocSize);
                         gammas = sk_sp<SkGammas>(new (memory) SkGammas());
 
                         uint32_t offset = 0;
                         gammas->fRedType = rType;
                         offset += load_gammas(memory, offset, rType, &rData, rParams,
                                               r->addr(base));
 
                         gammas->fGreenType = gType;
                         offset += load_gammas(memory, offset, gType, &gData, gParams,
@@ skipping 267 matching lines @@
     ptr32[4] = SkEndian_SwapBE32(0x000116cc);
     ptr += kTAG_XYZ_Bytes;
 
     // Write copyright tag
     memcpy(ptr, gEmptyTextTag, sizeof(gEmptyTextTag));
 
     // TODO (msarett): Should we try to hold onto the data so we can return immediately if
     //                 the client calls again?
     return SkData::MakeFromMalloc(profile.release(), kICCProfileSize);
 }