I'm investigating how to make the IPC transfer a bit more secure on the

src/effects/SkLightingImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkLightingImageFilter.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ skipping 46 matching lines @@
 
 class DiffuseLightingType {
 public:
     DiffuseLightingType(SkScalar kd)
         : fKD(kd) {}
     SkPMColor light(const SkPoint3& normal, const SkPoint3& surfaceTolight, const SkPoint3& lightColor) const {
         SkScalar colorScale = SkScalarMul(fKD, normal.dot(surfaceTolight));
         colorScale = SkScalarClampMax(colorScale, SK_Scalar1);
         SkPoint3 color(lightColor * colorScale);
         return SkPackARGB32(255,
-                            SkScalarFloorToInt(color.fX),
-                            SkScalarFloorToInt(color.fY),
-                            SkScalarFloorToInt(color.fZ));
+                            SkClampMax(SkScalarFloorToInt(color.fX), 255),
+                            SkClampMax(SkScalarFloorToInt(color.fY), 255),
+                            SkClampMax(SkScalarFloorToInt(color.fZ), 255));
     }
 private:
     SkScalar fKD;
 };
 
 class SpecularLightingType {
 public:
     SpecularLightingType(SkScalar ks, SkScalar shininess)
         : fKS(ks), fShininess(shininess) {}
     SkPMColor light(const SkPoint3& normal, const SkPoint3& surfaceTolight, const SkPoint3& lightColor) const {
         SkPoint3 halfDir(surfaceTolight);
         halfDir.fZ += SK_Scalar1;        // eye position is always (0, 0, 1)
         halfDir.normalize();
         SkScalar colorScale = SkScalarMul(fKS,
             SkScalarPow(normal.dot(halfDir), fShininess));
         colorScale = SkScalarClampMax(colorScale, SK_Scalar1);
         SkPoint3 color(lightColor * colorScale);
-        return SkPackARGB32(SkScalarFloorToInt(color.maxComponent()),
-                            SkScalarFloorToInt(color.fX),
-                            SkScalarFloorToInt(color.fY),
-                            SkScalarFloorToInt(color.fZ));
+        return SkPackARGB32(SkClampMax(SkScalarFloorToInt(color.maxComponent()), 255),
+                            SkClampMax(SkScalarFloorToInt(color.fX), 255),
+                            SkClampMax(SkScalarFloorToInt(color.fY), 255),
+                            SkClampMax(SkScalarFloorToInt(color.fZ), 255));
     }
 private:
     SkScalar fKS;
     SkScalar fShininess;
 };
 
 inline SkScalar sobel(int a, int b, int c, int d, int e, int f, SkScalar scale) {
     return SkScalarMul(SkIntToScalar(-a + b - 2 * c + 2 * d -e + f), scale);
 }
 
@@ skipping 552 matching lines @@
 };
 
 ///////////////////////////////////////////////////////////////////////////////
 
 class SkSpotLight : public SkLight {
 public:
     SkSpotLight(const SkPoint3& location, const SkPoint3& target, SkScalar specularExponent, SkScalar cutoffAngle, SkColor color)
      : INHERITED(color),
        fLocation(location),
        fTarget(target),
-       fSpecularExponent(specularExponent)
+       fSpecularExponent(SkScalarPin(specularExponent, kSpecularExponentMin, kSpecularExponentMax))
     {
        fS = target - location;
        fS.normalize();
        fCosOuterConeAngle = SkScalarCos(SkDegreesToRadians(cutoffAngle));
        const SkScalar antiAliasThreshold = SkFloatToScalar(0.016f);
        fCosInnerConeAngle = fCosOuterConeAngle + antiAliasThreshold;
        fConeScale = SkScalarInvert(antiAliasThreshold);
     }
 
     SkPoint3 surfaceToLight(int x, int y, int z, SkScalar surfaceScale) const {
@@ skipping 63 matching lines @@
 
         const SkSpotLight& o = static_cast<const SkSpotLight&>(other);
         return INHERITED::isEqual(other) &&
                fLocation == o.fLocation &&
                fTarget == o.fTarget &&
                fSpecularExponent == o.fSpecularExponent &&
                fCosOuterConeAngle == o.fCosOuterConeAngle;
     }
 
 private:
+    static const SkScalar kSpecularExponentMin;
+    static const SkScalar kSpecularExponentMax;
+
     typedef SkLight INHERITED;
     SkPoint3 fLocation;
     SkPoint3 fTarget;
     SkScalar fSpecularExponent;
     SkScalar fCosOuterConeAngle;
     SkScalar fCosInnerConeAngle;
     SkScalar fConeScale;
     SkPoint3 fS;
 };
 
+// According to the spec, the specular term should be in the range [1, 128] :
+// http://www.w3.org/TR/SVG/filters.html#feSpecularLightingSpecularExponentAttribute
+const SkScalar SkSpotLight::kSpecularExponentMin = SkFloatToScalar(1.0f);
+const SkScalar SkSpotLight::kSpecularExponentMax = SkFloatToScalar(128.0f);
+
 ///////////////////////////////////////////////////////////////////////////////
 
 SkLightingImageFilter::SkLightingImageFilter(SkLight* light, SkScalar surfaceScale, SkImageFilter* input, const SkIRect* cropRect)
   : INHERITED(input, cropRect),
     fLight(light),
     fSurfaceScale(SkScalarDiv(surfaceScale, SkIntToScalar(255)))
 {
     SkASSERT(fLight);
     // our caller knows that we take ownership of the light, so we don't
     // need to call ref() here.
@@ skipping 771 matching lines @@
 
 #endif
 
 SK_DEFINE_FLATTENABLE_REGISTRAR_GROUP_START(SkLightingImageFilter)
     SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkDiffuseLightingImageFilter)
     SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkSpecularLightingImageFilter)
     SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkDistantLight)
     SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkPointLight)
     SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkSpotLight)
 SK_DEFINE_FLATTENABLE_REGISTRAR_GROUP_END