| Index: src/core/SkBitmap.cpp
|
| diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
|
| index 128726cb63d9198477afd698e377c6ee02cef6ed..048df3e77d82476dfb9eb88c59172f6ee805c2da 100644
|
| --- a/src/core/SkBitmap.cpp
|
| +++ b/src/core/SkBitmap.cpp
|
| @@ -19,6 +19,7 @@
|
| #include "SkThread.h"
|
| #include "SkUnPreMultiply.h"
|
| #include "SkUtils.h"
|
| +#include "SkValidationUtils.h"
|
| #include "SkPackBits.h"
|
| #include <new>
|
|
|
| @@ -1606,9 +1607,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
|
| int width = buffer.readInt();
|
| int height = buffer.readInt();
|
| int rowBytes = buffer.readInt();
|
| - int config = buffer.readInt();
|
| + Config config = (Config)buffer.readInt();
|
| + buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) &&
|
| + SkIsValidConfig(config));
|
|
|
| - this->setConfig((Config)config, width, height, rowBytes);
|
| + this->setConfig(config, width, height, rowBytes);
|
| this->setIsOpaque(buffer.readBool());
|
|
|
| int reftype = buffer.readInt();
|
| @@ -1622,6 +1625,7 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
|
| case SERIALIZE_PIXELTYPE_NONE:
|
| break;
|
| default:
|
| + buffer.validate(false);
|
| SkDEBUGFAIL("unrecognized pixeltype in serialized data");
|
| sk_throw();
|
| }
|
|
|