Index: src/core/SkImageFilter.cpp |
diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp |
index c8c0c4dbf8257000d8eaa9bb07cf788a6730849d..704d01a22c19bab5f7f68e9876e82ebb6b0e61ca 100644 |
--- a/src/core/SkImageFilter.cpp |
+++ b/src/core/SkImageFilter.cpp |
@@ -10,6 +10,7 @@ |
#include "SkBitmap.h" |
#include "SkFlattenableBuffers.h" |
#include "SkRect.h" |
+#include "SkValidationUtils.h" |
#if SK_SUPPORT_GPU |
#include "GrContext.h" |
#include "GrTexture.h" |
@@ -75,9 +76,15 @@ SkImageFilter::SkImageFilter(SkFlattenableReadBuffer& buffer) |
} |
#ifdef SK_CROP_RECT_IS_INT |
buffer.readIRect(&fCropRect); |
+ // Do not use SkIsValidRect() here, since width() and height() are allowed |
+ // to be larger than SK_MaxS32 in this specific case. Check inversion instead. |
+ buffer.validate(!fCropRect.isInverted()); |
#else |
buffer.readRect(&fCropRect.fRect); |
fCropRect.fFlags = buffer.readUInt(); |
+ // Do not use SkIsValidRect() here, since width() and height() are allowed |
+ // to be larger than SK_MaxS32 in this specific case. Check inversion instead. |
+ buffer.validate(!fCropRect.fRect.isInverted()); |
#endif |
} |