| Index: src/core/SkImageFilter.cpp
|
| diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
|
| index c8c0c4dbf8257000d8eaa9bb07cf788a6730849d..704d01a22c19bab5f7f68e9876e82ebb6b0e61ca 100644
|
| --- a/src/core/SkImageFilter.cpp
|
| +++ b/src/core/SkImageFilter.cpp
|
| @@ -10,6 +10,7 @@
|
| #include "SkBitmap.h"
|
| #include "SkFlattenableBuffers.h"
|
| #include "SkRect.h"
|
| +#include "SkValidationUtils.h"
|
| #if SK_SUPPORT_GPU
|
| #include "GrContext.h"
|
| #include "GrTexture.h"
|
| @@ -75,9 +76,15 @@ SkImageFilter::SkImageFilter(SkFlattenableReadBuffer& buffer)
|
| }
|
| #ifdef SK_CROP_RECT_IS_INT
|
| buffer.readIRect(&fCropRect);
|
| + // Do not use SkIsValidRect() here, since width() and height() are allowed
|
| + // to be larger than SK_MaxS32 in this specific case. Check inversion instead.
|
| + buffer.validate(!fCropRect.isInverted());
|
| #else
|
| buffer.readRect(&fCropRect.fRect);
|
| fCropRect.fFlags = buffer.readUInt();
|
| + // Do not use SkIsValidRect() here, since width() and height() are allowed
|
| + // to be larger than SK_MaxS32 in this specific case. Check inversion instead.
|
| + buffer.validate(!fCropRect.fRect.isInverted());
|
| #endif
|
| }
|
|
|
|
|