Index: src/core/SkImageFilter.cpp |
diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp |
index 502613bb68835caf66d4dcb4d893b90b6697a1ad..2aa9bcf2a88c92bde5305fd7254f834cb047017f 100644 |
--- a/src/core/SkImageFilter.cpp |
+++ b/src/core/SkImageFilter.cpp |
@@ -62,6 +62,11 @@ SkImageFilter::SkImageFilter(SkFlattenableReadBuffer& buffer) |
} |
} |
buffer.readIRect(&fCropRect); |
+ |
+ if ((fCropRect.fLeft > fCropRect.fRight) || |
+ (fCropRect.fTop > fCropRect.fBottom)) { |
+ buffer.setError(); |
+ } |
} |
void SkImageFilter::flatten(SkFlattenableWriteBuffer& buffer) const { |