I'm investigating how to make the IPC transfer a bit more secure on the

src/core/SkFlattenableSerialization.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkFlattenableSerialization.h"
 
 #include "SkData.h"
 #include "SkFlattenable.h"
+#include "SkImageFilter.h"
 #include "SkOrderedReadBuffer.h"
 #include "SkOrderedWriteBuffer.h"
 
 SkData* SkSerializeFlattenable(SkFlattenable* flattenable) {
     SkOrderedWriteBuffer writer(1024);
     writer.setFlags(SkOrderedWriteBuffer::kCrossProcess_Flag);
     writer.writeFlattenable(flattenable);
     uint32_t size = writer.bytesWritten();
     void* data = sk_malloc_throw(size);
     writer.writeToMemory(data);
     return SkData::NewFromMalloc(data, size);
 }
 
 SkFlattenable* SkDeserializeFlattenable(const void* data, size_t size) {
     SkOrderedReadBuffer buffer(data, size);
     return buffer.readFlattenable();
 }
+
+bool SkValidateImageFilterRec(SkFlattenable* flattenable) {
+    if (!flattenable
+        // This object should always have been sent cross-process,
+        // so it should always have a factory
+        || !flattenable->getFactory()
+        // Only SkImageFilter objects are allowed
+        || !flattenable->isA(SkFlattenable::IMAGE_FILTER))
+        return false;
+
+    // Check that all the inputs are also SkImageFilter objects
+    SkImageFilter* filter = static_cast<SkImageFilter*>(flattenable);
+    int nbInputs = filter->countInputs();
+    for (int i = 0; i < nbInputs; ++i)
+        if (!SkValidateImageFilterRec(filter->getInput(i)))
+            return false;
+
+    return true;
+}
+
+SkImageFilter* SkValidateImageFilter(SkFlattenable* flattenable) {
+    return SkValidateImageFilterRec(flattenable) ?
+           static_cast<SkImageFilter*>(flattenable) : 0;
+}